From: Kevin P. Fleming <kpfleming@digium.com>
Date: Wed, 16 Aug 2006 18:57:44 +0000 (+0000)
Subject: don't allow AUEP responses to overflow the stack during a string copy (reported by... 
X-Git-Tag: 1.2.11~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3a46b712e2d3c6b016512312200dcf7e4540e09;p=thirdparty%2Fasterisk.git

don't allow AUEP responses to overflow the stack during a string copy (reported by Mu Security)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@40057 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 8190d9e3ae..cb3c3d7ced 100644
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -2478,12 +2478,14 @@ static void handle_response(struct mgcp_endpoint *p, struct mgcp_subchannel *sub
 						if (strncasecmp(v, p->sub->cxident, len) &&
 						    strncasecmp(v, p->sub->next->cxident, len)) {
 							/* connection id not found. delete it */
-							char cxident[80];
-							memcpy(cxident, v, len);
-							cxident[len] = '\0';
+							char cxident[80] = "";
+
+							if (len > (sizeof(cxident) - 1))
+								len = sizeof(cxident) - 1;
+							ast_copy_string(cxident, v, len);
 							if (option_verbose > 2) {
 								ast_verbose(VERBOSE_PREFIX_3 "Non existing connection id %s on %s@%s \n", 
-									cxident, p->name, gw->name);
+									    cxident, p->name, gw->name);
 							}
 							transmit_connection_del_w_params(p, NULL, cxident);
 						}