From 4a4b8fec18989fbcef5a8f152dd679c7ffbc15d7 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Thu, 3 Jul 2025 14:57:40 -0400
Subject: [PATCH] MT#62181 StatsUDPServer: fix possible overrun

The parsing code expect a null-terminated string. Make sure the string
is.

Use correct ssize_t as return value.

Change-Id: I2590dead0db5ca839ebe5fe7506b4edfe524d164
---
 core/plug-in/stats/StatsUDPServer.cpp | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/core/plug-in/stats/StatsUDPServer.cpp b/core/plug-in/stats/StatsUDPServer.cpp
index 2b01ddb2..8286ee2a 100644
--- a/core/plug-in/stats/StatsUDPServer.cpp
+++ b/core/plug-in/stats/StatsUDPServer.cpp
@@ -196,13 +196,15 @@ void StatsUDPServer::run()
   struct sockaddr_in addr;
   socklen_t addrlen = sizeof(struct sockaddr_in);
 
-  char msg_buf[MSG_BUF_SIZE];
-  int  msg_buf_s;
+  char msg_buf[MSG_BUF_SIZE + 1];
+  ssize_t  msg_buf_s;
 
-  while(true){
+  while (!stop_requested()) {
 
     msg_buf_s = recvfrom(sd,msg_buf,MSG_BUF_SIZE,0,(sockaddr*)&addr,&addrlen);
-    if(msg_buf_s == -1){
+    if (!msg_buf_s)
+      continue;
+    if (msg_buf_s < 0){
 
       switch(errno){
       case EINTR:
@@ -215,6 +217,8 @@ void StatsUDPServer::run()
       break;
     }
 
+    msg_buf[msg_buf_s] = '\0';
+
     //printf("received packet from: %s:%i\n",
     //       inet_ntoa(addr.sin_addr),ntohs(addr.sin_port));