[PROTON-76] Suspiciously insufficient looking buffer allocation in messenger.c

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Component/s: proton-c
• Assignee: Rafael H. Schloming
• Reporter: Robert Godfrey
• Created: 15/Oct/12 12:11
• Updated: 08/Jan/16 10:57
• Resolved: 19/Oct/12 22:01

Description

Lines 541-549:

if (len > 1 && address[0] == '~' && address[1] == '/')

{ char buf[len + strlen(mng->name) + 4]; sprintf(buf, "amqp://%s/%s", mng->name, address); pn_message_set_reply_to(msg, buf); }

else if (len == 0)

{ char buf[strlen(mng->name) + 4]; sprintf(buf, "amqp://%s", mng->name); pn_message_set_reply_to(msg, buf); }

should the first "4" not be an "8" and the second a "7"?