static void upnp_event_prepare(struct upnp_event_notify * obj)
{

	obj->buffersize = 1024; /* Static Buffer Size */
	obj->buffer = malloc(obj->buffersize);
	[...]
	obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
	                       obj->path, obj->addrstr, obj->portstr, l+2,
	                       obj->sub->uuid, obj->sub->seq,
	                       l, xml);
	obj->state = ESending;

static void upnp_event_send(struct upnp_event_notify * obj)
{
	int i;
	i = send(obj->s, obj->buffer + obj->sent, obj->tosend - obj->sent, 0);

RETURN VALUE

Upon successful return, functions return the number of characters printed 
(excluding the null byte used to end output to strings).

The functions snprintf() and vsnprintf() do not write more than size bytes 
(including the terminating  null byte ('\0')).  If the output was truncated 
due to this limit, then the return value is the number of characters 
(excluding the terminating null byte) which would have been written to the 
final string if enough space had been available. Thus, a return value of size 
or more means that the output was truncated.

usage: miniupnpd_poc.py [-h] [--callback_ip CALLBACK_IP]
                        [--callback_port CALLBACK_PORT] [--timeout TIMEOUT]
                        [--leak_amount LEAK_AMOUNT]
                        target_ip target_port

Miniupnpd <= v2.1 read out-of-bounds vulnerability

positional arguments:
  target_ip             IP address of vulnerable device.
  target_port           Target Port.

optional arguments:
  -h, --help            show this help message and exit
  --callback_ip CALLBACK_IP
                        Local IP address for httpd listener. (default: None)
  --callback_port CALLBACK_PORT
                        Local port for httpd listener. (default: None)
  --timeout TIMEOUT     Timeout for http requests (seconds). (default: 5)
  --leak_amount LEAK_AMOUNT
                        Amount of arbitrary heap data to leak (in Kb).
                        (default: 1)