Skip to content
Snippets Groups Projects
  • Richard Mudgett's avatar
    7cd99be5
    PJSIP XML, XPIDF: Fix buffer size overwrite memory corruption error. · 7cd99be5
    Richard Mudgett authored
    When res_pjsip body generator modules were generating XML or XPIDF
    response bodies, there was a chance that the generated body would be the
    exact size of the supplied buffer.  Adding the nul string terminator would
    then write beyond the end of the buffer and potentially corrupt memory.
    
    * Fix MALLOC_DEBUG high fence violations caused by adding a nul string
    terminator on the end of a buffer for XML or XPIDF response bodies.
    
    * Made calls to pj_xml_print() safer if the XML prolog is requested.  Due
    to a bug in pjproject, the return value could be -1 _or_
    AST_PJSIP_XML_PROLOG_LEN if the supplied buffer is not large enough.
    
    * Updated the doxygen comment of AST_PJSIP_XML_PROLOG_LEN to describe the
    return value of pj_xml_print() when the supplied buffer is not large
    enough.
    
    ASTERISK-25168
    Reported by: Carl Fortin
    
    Change-Id: Id70e1d373a6a2b2bd9e678b5cbc5e55b308981de
    7cd99be5
    History
    PJSIP XML, XPIDF: Fix buffer size overwrite memory corruption error.
    Richard Mudgett authored
    When res_pjsip body generator modules were generating XML or XPIDF
    response bodies, there was a chance that the generated body would be the
    exact size of the supplied buffer.  Adding the nul string terminator would
    then write beyond the end of the buffer and potentially corrupt memory.
    
    * Fix MALLOC_DEBUG high fence violations caused by adding a nul string
    terminator on the end of a buffer for XML or XPIDF response bodies.
    
    * Made calls to pj_xml_print() safer if the XML prolog is requested.  Due
    to a bug in pjproject, the return value could be -1 _or_
    AST_PJSIP_XML_PROLOG_LEN if the supplied buffer is not large enough.
    
    * Updated the doxygen comment of AST_PJSIP_XML_PROLOG_LEN to describe the
    return value of pj_xml_print() when the supplied buffer is not large
    enough.
    
    ASTERISK-25168
    Reported by: Carl Fortin
    
    Change-Id: Id70e1d373a6a2b2bd9e678b5cbc5e55b308981de