Commit 098018df3d for freeswitch.com

commit 098018df3dc2766f08c9d25bebc69014b6e4bed5
Author: Dmitry Verenitsin <morbit85@gmail.com>
Date:   Wed Aug 26 18:01:18 2026 +0500

    [mod_sofia] Bound the To-user split in the inbound MESSAGE handler (#3134)

    `sofia_presence_handle_sip_i_message()` splits the chat proto selector off a
    truncating copy of the To user. Split only a user that fits the buffer; an
    over-long one is handled as a plain address.

diff --git a/src/mod/endpoints/mod_sofia/sofia_presence.c b/src/mod/endpoints/mod_sofia/sofia_presence.c
index 1737eb4774..d9257285a1 100644
--- a/src/mod/endpoints/mod_sofia/sofia_presence.c
+++ b/src/mod/endpoints/mod_sofia/sofia_presence.c
@@ -4871,7 +4871,10 @@ void sofia_presence_handle_sip_i_message(int status,

 			full_from = sip_header_as_string(nua_handle_get_home(nh), (void *) sip->sip_from);

-			if ((p = strchr(to_user, '+')) && p != to_user) {
+			/* Only split a user that fits in proto: the copy below truncates, so a '+' past the
+			   buffer would leave nothing to split on, and a selector or address cut in half must
+			   not be parsed either. An over-long user is treated as a plain address. */
+			if ((p = strchr(to_user, '+')) && p != to_user && strlen(to_user) < sizeof(proto)) {
 				switch_copy_string(proto, to_user, sizeof(proto));
 				p = strchr(proto, '+');
 				*p++ = '\0';