<p>In <a href="https://github.com/OpenSIPS/opensips/pull/475#discussion_r28850995">db/db.h</a>:</p>
<pre style='color:#555'>> @@ -454,6 +454,7 @@ int estimate_available_rows( int payload_size, int column_count);
>                 } else {\
>                         _db_url.len = strlen(_db_url.s); \
>                 } \
> +                _db_url.s[_db_url.len+1] = '\0'; \
</pre>
<p>I think this is a bit broken:</p>
<ol class="task-list">
<li>_db_url.s - is already NULL terminated, because otherwise strlen() would not work</li>
<li>you are adding '\0' after the end of the string (the '\0') - this is a buffer overflow.</li>
<li>there is one branch where _db_url.len is not initialized - if there is no DB specified and no default one</li>
</ol>
<p>I think we'd better investigate the root cause :)</p>
<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br>Reply to this email directly or <a href="https://github.com/OpenSIPS/opensips/pull/475/files#r28850995">view it on GitHub</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/AFOciXTV--1_V0YM8QrRfOD3YbwVkCESks5oB0qjgaJpZM4EFvIx.gif" width="1" /></p>
<div itemscope itemtype="http://schema.org/EmailMessage">
<div itemprop="action" itemscope itemtype="http://schema.org/ViewAction">
<link itemprop="url" href="https://github.com/OpenSIPS/opensips/pull/475/files#r28850995"></link>
<meta itemprop="name" content="View Pull Request"></meta>
</div>
<meta itemprop="description" content="View this Pull Request on GitHub"></meta>
</div>