kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-06 12:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Additional check for more string specifiers than arguments.

Browse Source 
(closes issue #13299)
 Reported by: adomjan
 Patches: 
       20080813__bug13299.diff.txt uploaded by Corydon76 (license 14)
       func_strings.c-sprintf.patch uploaded by adomjan (license 487)
 Tested by: adomjan


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@138023 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Tilghman Lesher
2008-08-15 14:51:12 +00:00
parent 5dff477c3e
commit e647244fe8
1 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
funcs/func_strings.c
View File

@@ -300,8 +300,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
formatbuf[&arg.format[i] - formatstart + 1] = '\0';
/* Convert the argument into the required type */
if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
if (arg.var[argcount]) {
if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
goto sprintf_fail;
}
} else {
ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
goto sprintf_fail;
}
@@ -318,8 +323,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
formatbuf[&arg.format[i] - formatstart + 1] = '\0';
/* Convert the argument into the required type */
if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
if (arg.var[argcount]) {
if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
goto sprintf_fail;
}
} else {
ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
goto sprintf_fail;
}
@@ -366,6 +376,7 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
}
}
}
*bufptr = '\0';
return 0;
sprintf_fail:
return -1;