Browse code

topoh: detect when via param is shorter than expected prefix

(cherry picked from commit e6950ffb1985493e717e3d774eddad779aed1514)

Daniel-Constantin Mierla authored on 02/03/2019 12:40:47 • Henning Westerholt committed on 03/04/2019 21:26:50
Showing 1 changed files
... ...
@@ -410,12 +410,17 @@ int th_unmask_via(sip_msg_t *msg, str *cookie)
410 410
 					LM_ERR("cannot find param in via %d\n", i);
411 411
 					return -1;
412 412
 				}
413
-				if(i==2)
413
+				if(vp->value.len <= th_vparam_prefix.len) {
414
+					LM_ERR("invalid param len in via %d\n", i);
415
+					return -1;
416
+				}
417
+				if(i==2) {
414 418
 					out.s = th_mask_decode(vp->value.s, vp->value.len,
415 419
 							&th_vparam_prefix, CRLF_LEN+1, &out.len);
416
-				else
420
+				} else {
417 421
 					out.s = th_mask_decode(vp->value.s, vp->value.len,
418 422
 							&th_vparam_prefix, 0, &out.len);
423
+				}
419 424
 				if(out.s==NULL || out.len<=0)
420 425
 				{
421 426
 					LM_ERR("cannot decode via %d\n", i);