diff options
| author | Neels Hofmeyr <neels@hofmeyr.de> | 2017-12-18 04:08:02 +0100 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2017-12-20 15:49:38 +0000 |
| commit | 26c218d0e725aee8218c93c3bdda698a8f945208 (patch) | |
| tree | adc7dcc30e671b60378440e1463db90e413b8c82 | |
| parent | 9baedafa244e19624a7c115f2fa8d5d96c657937 (diff) | |
smpp_smsc: fix truncated string copy into bind_r.system_id
The target buffer in libsmpp is 16 bytes long, and snprintf() may omit the
terminating zero. There seems to be no handling for unterminated strings, so
osmo_strlcpy() is the safer (and presumably more optimal) choice.
Change-Id: I5845666201f945ea9f83da62f2dd4bec52eb74cf
| -rw-r--r-- | src/libmsc/smpp_smsc.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/libmsc/smpp_smsc.c b/src/libmsc/smpp_smsc.c index 88cecfc4e..34b93f88f 100644 --- a/src/libmsc/smpp_smsc.c +++ b/src/libmsc/smpp_smsc.c @@ -509,8 +509,7 @@ static int smpp_handle_bind_tx(struct osmo_esme *esme, struct msgb *msg) bind_r.command_status = rc; /* build response */ - snprintf((char *)bind_r.system_id, sizeof(bind_r.system_id), "%s", - esme->smsc->system_id); + osmo_strlcpy((char*)bind_r.system_id, esme->smsc->system_id, sizeof(bind_r.system_id)); /* add interface version TLV */ tlv.tag = TLVID_sc_interface_version; |