status-im
/
miniupnp
mirror of https://github.com/status-im/miniupnp.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

upnpevents.c: properly handle urls in the form http://ip:port 

Fix buffer over-read in upnpevents.c with urls in the form http://ip:port
(without path).
Assume / when the path is empty

fixes #361
This commit is contained in:
Thomas Bernard 2019-04-09 22:06:21 +02:00
parent 922372bff3
commit 1ef1deec01
No known key found for this signature in database
GPG Key ID: 0FF11B67A5C0863C
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
miniupnpd/Changelog.txt
View File

@ -1,4 +1,7 @@
$Id: Changelog.txt,v 1.444 2019/04/03 16:25:53 nanard Exp $ $Id: Changelog.txt,v 1.446 2019/04/09 20:04:32 nanard Exp $
2019/04/09:
Fix buffer over-read in upnpevents.c with urls in the form http://ip:port
2019/04/05: 2019/04/05:
Fix memory leak in upnpreplyparse.c with NewPortListing element Fix memory leak in upnpreplyparse.c with NewPortListing element

9
miniupnpd/upnpevents.c
View File

@ -1,8 +1,8 @@
/* $Id: upnpevents.c,v 1.39 2018/03/12 22:41:54 nanard Exp $ */ /* $Id: upnpevents.c,v 1.42 2019/04/09 20:04:34 nanard Exp $ */
/* vim: tabstop=4 shiftwidth=4 noexpandtab /* vim: tabstop=4 shiftwidth=4 noexpandtab
* MiniUPnP project * MiniUPnP project
* http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/ * http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/
* (c) 2008-2018 Thomas Bernard * (c) 2008-2019 Thomas Bernard
* This software is subject to the conditions detailed * This software is subject to the conditions detailed
* in the LICENCE file provided within the distribution */ * in the LICENCE file provided within the distribution */
@ -341,7 +341,7 @@ upnp_event_notify_connect(struct upnp_event_notify * obj)
i = 1; i = 1;
p++; p++;
port = (unsigned short)atoi(p); port = (unsigned short)atoi(p);
while(*p != '/') { while(*p != '\0' && *p != '/') {
if(i<7) obj->portstr[i++] = *p; if(i<7) obj->portstr[i++] = *p;
p++; p++;
} }
@ -454,7 +454,8 @@ static void upnp_event_prepare(struct upnp_event_notify * obj)
return; return;
} }
obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg, obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
obj->path, obj->addrstr, obj->portstr, l+2, (obj->path[0] != '\0') ? obj->path : "/",
obj->addrstr, obj->portstr, l+2,
obj->sub->uuid, obj->sub->seq, obj->sub->uuid, obj->sub->seq,
l, xml); l, xml);
if (obj->tosend < 0) { if (obj->tosend < 0) {