#42 Potential problem with not null-terminated strings in AVPs

[Anonymous]

There might be an issue in the method l2tp_session_store_avps (l2tp_session.c) if the AVPs are not null-terminated. We are using v1.8 and when I do a "session show" in l2tpconfig I get trailing garbage after "calling number" and "called number" on the sessions from some equipment (vendor name "StarentNetworks"). Since the AVPs have a length-information I am guessing that the Starent does not send null-terminated strings and since l2tp_session_store_avps simply uses strdup without looking at the length information the resulting strings stored in struct l2tp_session can be to long. Using strndup with the length-information should avoid this.

AVPs that are stored in struct tunnel (l2tp_tunnel_store_avps in l2tp_tunnel.c) are handled differently, for example VENDOR_NAME/HOST_NAME are always stored null-terminated