fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmo-mgw/+/35322?usp=email )

Change subject: mgcp: reserve once byte for '\0' in mgcp_do_read() ......................................................................

mgcp: reserve once byte for '\0' in mgcp_do_read()

We need to be able to terminate the received string in case it was not nul-terminated by the sender (see mgcp_msg_terminate_nul()).

Change-Id: Icc878af7f671213bb516af62cb601914d86ff808 Fixes: CID#272990 --- M src/libosmo-mgcp-client/mgcp_client.c 1 file changed, 15 insertions(+), 1 deletion(-)

Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve daniel: Looks good to me, but someone else must approve

diff --git a/src/libosmo-mgcp-client/mgcp_client.c b/src/libosmo-mgcp-client/mgcp_client.c index 8693b1b..cd73391 100644 --- a/src/libosmo-mgcp-client/mgcp_client.c +++ b/src/libosmo-mgcp-client/mgcp_client.c @@ -758,7 +758,8 @@ return -1; }

- ret = read(fd->fd, msg->data, 4096 - 128); + /* msgb_tailroom() is basically (4096 - 128); -1 is for '\0' */ + ret = read(fd->fd, msg->data, msgb_tailroom(msg) - 1); if (ret <= 0) { LOGPMGW(mgcp, LOGL_ERROR, "Failed to read: %s: %d='%s'\n", osmo_sock_get_name2(fd->fd), errno, strerror(errno));