From 1780e6c5df6109c82932c2b4ef6bd7e819ea1cc6 Mon Sep 17 00:00:00 2001 From: Sauw Ming Date: Thu, 8 Mar 2018 23:54:40 +0000 Subject: [PATCH] Re #2098: Fixed insufficient buffer length to avoid message truncation. git-svn-id: https://svn.pjsip.org/repos/pjproject/trunk@5753 74dad513-b988-da41-8d7b-12977e46ad98 --- pjmedia/src/pjmedia/sdp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c index d3ec6c6ed..67118c1bb 100644 --- a/pjmedia/src/pjmedia/sdp.c +++ b/pjmedia/src/pjmedia/sdp.c @@ -548,8 +548,9 @@ PJ_DEF(pjmedia_sdp_attr*) pjmedia_sdp_attr_create_ssrc( pj_pool_t *pool, attr = PJ_POOL_ALLOC_T(pool, pjmedia_sdp_attr); attr->name = pj_str("ssrc"); attr->value.ptr = (char*) pj_pool_alloc(pool, cname->slen+7 /* " cname:"*/ - + 10 /* 32-bit integer */); - attr->value.slen = pj_ansi_snprintf(attr->value.ptr, cname->slen+17, + + 10 /* 32-bit integer */ + + 1 /* NULL */); + attr->value.slen = pj_ansi_snprintf(attr->value.ptr, cname->slen+18, "%d cname:%.*s", ssrc, (int)cname->slen, cname->ptr);