Use snprintf instead of sprintf in one place. There is no vulnerability here

due to various buffer sizes around the code, but I still didn't like seeing a
non length-limited copy of data coming off of the wire into a stack buffer, as
this would be a problem in the future if buffer sizes elsewhere got changed or
size limitations removed ...

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@84370 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 4b7d3a88991a9cd2db2b4f1d4069309fe4279479..98e10c5fa1b8998d9d4d0732fb2eeec91b202c1d 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -6939,7 +6939,7 @@ static int transmit_invite(struct sip_pvt *p, int sipmethod, int sdp, int init)
                        if (!ast_strlen_zero(p->refer->refer_to))
                                add_header(&req, "Refer-To", p->refer->refer_to);
                        if (!ast_strlen_zero(p->refer->referred_by)) {
-                               sprintf(buf, "%s <%s>", p->refer->referred_by_name, p->refer->referred_by);
+                               snprintf(buf, sizeof(buf), "%s <%s>", p->refer->referred_by_name, p->refer->referred_by);
                                add_header(&req, "Referred-By", buf);
                        }
                }