FSCORE-676 Buffer too small

This commit is contained in:
Jeff Lenk 2010-09-23 08:15:55 -05:00
parent b02c69bba9
commit 0cc28f37fb
6 changed files with 6 additions and 6 deletions

View File

@ -3045,7 +3045,7 @@ SWITCH_STANDARD_API(xml_wrap_api_function)
if (mystream.data) {
if (encoded) {
elen = (int) strlen(mystream.data) * 3;
elen = (int) strlen(mystream.data) * 3 + 1;
edata = malloc(elen);
switch_assert(edata != NULL);
memset(edata, 0, elen);

View File

@ -3733,7 +3733,7 @@ static switch_status_t conf_api_sub_list(conference_obj_t *conference, switch_st
static switch_xml_t add_x_tag(switch_xml_t x_member, const char *name, const char *value, int off)
{
switch_size_t dlen = strlen(value) * 3;
switch_size_t dlen = strlen(value) * 3 + 1;
char *data;
switch_xml_t x_tag;

View File

@ -3678,7 +3678,7 @@ static int web_callback(void *pArg, int argc, char **argv, char **columnNames)
const char *fmt = "%a, %e %b %Y %T %z";
char heard[80];
char title_b4[128] = "";
char title_aft[128 * 3] = "";
char title_aft[128 * 3 + 1] = "";
if (argc > 0) {
l_created = switch_time_make(atol(argv[0]), 0);

View File

@ -1100,7 +1100,7 @@ static int web_callback(void *pArg, int argc, char **argv, char **columnNames)
{
struct holder *holder = (struct holder *) pArg;
char title_b4[128] = "";
char title_aft[128 * 3] = "";
char title_aft[128 * 3 + 1] = "";
char *mp3, *m3u;
/*

View File

@ -264,7 +264,7 @@ static switch_status_t my_on_reporting(switch_core_session_t *session)
if (globals.encode == ENCODING_TEXTXML) {
headers = curl_slist_append(headers, "Content-Type: text/xml");
} else if (globals.encode) {
switch_size_t need_bytes = strlen(xml_text) * 3;
switch_size_t need_bytes = strlen(xml_text) * 3 + 1;
xml_text_escaped = malloc(need_bytes);
switch_assert(xml_text_escaped);

View File

@ -1841,7 +1841,7 @@ SWITCH_DECLARE(int) switch_ivr_set_xml_chan_vars(switch_xml_t xml, switch_channe
for (; hi; hi = hi->next) {
if (!zstr(hi->name) && !zstr(hi->value) && ((variable = switch_xml_add_child_d(xml, hi->name, off++)))) {
char *data;
switch_size_t dlen = strlen(hi->value) * 3;
switch_size_t dlen = strlen(hi->value) * 3 + 1;
if ((data = malloc(dlen))) {
memset(data, 0, dlen);