res_pjsip_header_funcs.c: Check URI parameter length before copying.

Fixes #477

(cherry picked from commit a2f0d99d9d6458a5bee73aeefb44bc0ae99d81df)

diff --git a/res/res_pjsip_header_funcs.c b/res/res_pjsip_header_funcs.c
index ad9be741eca8298b580992f29070cda925648130..3272d18c09f5e1378d31e1204b663a2bff3e3d6f 100644 (file)
--- a/res/res_pjsip_header_funcs.c
+++ b/res/res_pjsip_header_funcs.c
@@ -1098,8 +1098,10 @@ static int read_param(void *obj)
 
        ast_debug(2, "Successfully read %s parameter %s (length %zu)\n",
                data->paramtype == PARAMETER_URI ? "URI" : "header", data->param_name, param_len);
-       ast_copy_string(data->buf, pj_strbuf(&param->value), data->len);
-       data->buf[pj_strlen(&param->value)] = '\0';
+       if (param_len) {
+               ast_copy_string(data->buf, pj_strbuf(&param->value), data->len);
+       }
+       data->buf[param_len] = '\0';
 
        return 0;
 }