From 1035ef957c651b1c8f74d4ce62f5b6fbacabe40a Mon Sep 17 00:00:00 2001 From: Scott Griepentrog Date: Wed, 21 May 2014 18:58:47 +0000 Subject: [PATCH] pbx.c: prevent potential crash from recursive replace() Recurisve usage of replace() resulted in corruption of the temporary string storage and potential crash. By changing the string to be allocated separtely per instance, this is eliminated. ASTERISK-23650 #comment Reported by: Roel van Meer ASTERISK-23650 #close Review: https://reviewboard.asterisk.org/r/3539/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@414214 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- funcs/func_strings.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/funcs/func_strings.c b/funcs/func_strings.c index 767ea225b8..80e238e41c 100644 --- a/funcs/func_strings.c +++ b/funcs/func_strings.c @@ -780,7 +780,7 @@ static int replace(struct ast_channel *chan, const char *cmd, char *data, struct AST_APP_ARG(replace); ); char *strptr, *varsubst; - struct ast_str *str = ast_str_thread_get(&result_buf, 16); + RAII_VAR(struct ast_str *, str, ast_str_create(16), ast_free); char find[256]; /* Only 256 characters possible */ char replace[2] = ""; size_t unused;