[sofia-sip] Fix out-of-bounds write in sres_sofia_update().

andywolk · andywolk · commit 72869f13f607 · 2020-02-25T02:09:27.000+04:00
diff --git a/libs/sofia-sip/.update b/libs/sofia-sip/.update
@@ -1 +1 @@
-Thu Feb 20 12:12:22 UTC 2020
+Mon Feb 24 22:07:30 UTC 2020
diff --git a/libs/sofia-sip/libsofia-sip-ua/sresolv/sresolv.c b/libs/sofia-sip/libsofia-sip-ua/sresolv/sresolv.c
@@ -224,7 +224,7 @@ static int sres_sofia_update(sres_sofia_t *srs,
 	if (!(srs->srs_reg + i)->reg_ptr)
 	  break;
       }
-      if (i > N)
+      if (i >= N)
 	return su_seterrno(ENOMEM);
 
       reg = srs->srs_reg + i;

Original file line number	Diff line number	Diff line change
`@@ -224,7 +224,7 @@ static int sres_sofia_update(sres_sofia_t *srs,`
`224`	`224`	`if (!(srs->srs_reg + i)->reg_ptr)`
`225`	`225`	`break;`
`226`	`226`	`}`
`227`		`- if (i > N)`
	`227`	`+ if (i >= N)`
`228`	`228`	`return su_seterrno(ENOMEM);`
`229`	`229`
`230`	`230`	`reg = srs->srs_reg + i;`