File 0001-Patch-2.1-Fixes-heap-buffer-overflow-in-osip_body_to_s.patch of Package libosip2
--- src/osipparser2/osip_body_orig.c 2016-09-02 20:23:00.014265482 +0000
+++ src/osipparser2/osip_body.c 2016-09-02 20:34:39.606291823 +0000
@@ -378,7 +378,7 @@
osip_free (ptr);
return i;
}
- if (length < tmp_body - ptr + strlen (tmp) + 4) {
+ if (length <= tmp_body - ptr + strlen (tmp) + 4) {
size_t len;
len = tmp_body - ptr;
@@ -417,9 +417,18 @@
}
if ((osip_list_size (body->headers) > 0) || (body->content_type != NULL)) {
+ if (length <= tmp_body - ptr + 2) {
+ size_t len;
+
+ len = tmp_body - ptr;
+ length = length + 2;
+ ptr = osip_realloc (ptr, length);
+ tmp_body = ptr + len;
+ }
tmp_body = osip_strn_append (tmp_body, CRLF, 2);
}
- if (length < tmp_body - ptr + body->length + 4) {
+
+ if (length <= tmp_body - ptr + body->length + 4) {
size_t len;
len = tmp_body - ptr;