Commit 49f39c074a for freeswitch.com

commit 49f39c074a5bf81c754619e37ec9e39f2407101f
Author: Dmitry Verenitsin <morbit85@gmail.com>
Date:   Sat Aug 8 22:31:33 2026 +0500

    Merge commit from fork

    `sofia_dialog_probe_callback()` filled its fixed 512-byte
    `remote_display_buf` with unbounded `strcpy`. On the default path the
    source is the stored To-header user part, which `sip_dialogs.sip_to_user`
    holds verbatim from the wire with no truncation, so a dialog row
    addressed to a user part longer than 511 bytes overflowed the buffer
    when a `dialog`-package SUBSCRIBE ran the probe.

    Copy with `snprintf()` bounded by `sizeof(remote_display_buf)` on every
    path that writes it. The four proto branches write short fixed strings
    and could not overflow; they are converted for consistency. User parts
    under 512 bytes are copied unchanged.

diff --git a/src/mod/endpoints/mod_sofia/sofia_presence.c b/src/mod/endpoints/mod_sofia/sofia_presence.c
index c78f4579ac..1737eb4774 100644
--- a/src/mod/endpoints/mod_sofia/sofia_presence.c
+++ b/src/mod/endpoints/mod_sofia/sofia_presence.c
@@ -2017,7 +2017,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
 			buf_to_free = switch_mprintf("sip:queue+%s", to_user);
 		}
 		remote_uri = buf_to_free;
-		strcpy(remote_display_buf, "queue");
+		snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "queue");
 		remote_user = to_user;
 		remote_host = local_host;
 	}
@@ -2031,7 +2031,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
 			buf_to_free = switch_mprintf("sip:park+%s", to_user);
 		}
 		remote_uri = buf_to_free;
-		strcpy(remote_display_buf, "park");
+		snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "park");
 		remote_user = to_user;
 		remote_host = local_host;
 	}
@@ -2045,7 +2045,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
 			buf_to_free = switch_mprintf("sip:pickup+%s", to_user);
 		}
 		remote_uri = buf_to_free;
-		strcpy(remote_display_buf, "pickup");
+		snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "pickup");
 		remote_user = to_user;
 		remote_host = local_host;
 	}
@@ -2058,7 +2058,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
 			buf_to_free = switch_mprintf("sip:conf+%s@%s", to_user, host);
 		}
 		remote_uri = buf_to_free;
-		strcpy(remote_display_buf, "conference");
+		snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "conference");
 		remote_user = to_user;
 		remote_host = local_host;
 	}
@@ -2073,7 +2073,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
 		local_user = from_user;
 		buf_to_free = switch_mprintf("**%s@%s", from_user, local_host);
 		remote_uri = buf_to_free;
-		strcpy(remote_display_buf, to_user);
+		snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", to_user);
 		remote_user = to_user;
 		remote_host = local_host;
 	}