From fa15e170b41d9b1d301819eb46bc7f3fb32df297 Mon Sep 17 00:00:00 2001
From: Disconnect3d <dominik.b.czarnota@gmail.com>
Date: Mon, 13 Apr 2020 16:35:03 +0200
Subject: Fix incorrect "<iq from=\"' parsing

This PR fixes a wrong size arg passed to memcmp when checking for "<iq from=\"" and "<iq from \'" strings.
---
 src/lib/protocols/jabber.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/lib/protocols/jabber.c')

diff --git a/src/lib/protocols/jabber.c b/src/lib/protocols/jabber.c
index 6ee96e5af..9302f84d7 100644
--- a/src/lib/protocols/jabber.c
+++ b/src/lib/protocols/jabber.c
@@ -135,7 +135,7 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st
       return;
     }
     /* need message to or type for file-transfer */
-    if (memcmp(packet->payload, "<iq from=\"", 8) == 0 || memcmp(packet->payload, "<iq from=\'", 8) == 0) {
+    if (memcmp(packet->payload, "<iq from=\"", 10) == 0 || memcmp(packet->payload, "<iq from=\'", 10) == 0) {
       NDPI_LOG_DBG2(ndpi_struct, "JABBER <iq from=\"\n");
       lastlen = packet->payload_packet_len - 11;
       for (x = 10; x < lastlen; x++) {
-- 
cgit v1.2.3