kenmirrors/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2025-06-03 03:50:10 +00:00
Code Issues Projects Releases Wiki Activity

add better bounds checking in dtmf_accepting array to avoid buffer overrun in mod_voicemail_ivr

Browse Source
This commit is contained in:
Michael Jerris 2014-04-30 13:31:06 -04:00
parent a9a852477a
commit 0b8d2c5d65
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/mod/applications/mod_voicemail_ivr/ivr.c
View File

@ -41,10 +41,10 @@ static int match_dtmf(switch_core_session_t *session, ivre_data_t *loc) {
loc->completeMatch = NULL; loc->completeMatch = NULL;
loc->potentialMatchCount = 0; loc->potentialMatchCount = 0;
for (i = 0; i < loc->dtmf_received; i++) { for (i = 0; i < 16 && i < loc->dtmf_received; i++) {
int j; int j;
loc->potentialMatchCount = 0; loc->potentialMatchCount = 0;
for (j = 0; !zstr(loc->dtmf_accepted[j]) && j < 128; j++) { for (j = 0; j < 128 && !zstr(loc->dtmf_accepted[j]); j++) {
switch_bool_t cMatch = SWITCH_FALSE; switch_bool_t cMatch = SWITCH_FALSE;
char test[2] = { 0 }; char test[2] = { 0 };

2
src/mod/applications/mod_voicemail_ivr/ivr.h
View File

@ -36,7 +36,7 @@
struct ivre_data { struct ivre_data {
char dtmf_stored[128]; char dtmf_stored[128];
int dtmf_received; int dtmf_received;
char dtmf_accepted[16][128]; char dtmf_accepted[128][16];
int result; int result;
switch_bool_t audio_stopped; switch_bool_t audio_stopped;
switch_bool_t recorded_audio; switch_bool_t recorded_audio;