Bug in gw/wap_push_pap_compiler.c - infinite loop

In the function parse_content (), the lines

    while (octstr_get_char(*address, pos) !=
               octstr_get_char(nameos, 0) && pos >= 0) {
        pos = drop_character(address, pos);
    }

should be replaced with

    while ((octstr_len (*address) > 0) && octstr_get_char(*address, pos) !=
               octstr_get_char(nameos, 0) && pos >= 0) {
        pos = drop_character(address, pos);
    }

otherwise an infinite loop results. This is easy to reproduce. Drop
the /TYPE=xxx from an address in the PAP document. This should give
back an error; instead the WAP box hangs in an infinite loop.

Paul Keogh
ANAM Wireless Internet Solutions
http://www.anam.com
+353 1 284 7555 (wired)               +353 86 234 6047 (wireless)
Castle Yard, Saint Patrick's Road, Dalkey, County Dublin, Ireland