From 0cc28f37fb7c37e743d3263a9cac55f74578d430 Mon Sep 17 00:00:00 2001
From: Jeff Lenk <jeff@jefflenk.com>
Date: Thu, 23 Sep 2010 08:15:55 -0500
Subject: [PATCH] FSCORE-676 Buffer too small

---
 src/mod/applications/mod_commands/mod_commands.c     | 2 +-
 src/mod/applications/mod_conference/mod_conference.c | 2 +-
 src/mod/applications/mod_voicemail/mod_voicemail.c   | 2 +-
 src/mod/formats/mod_shout/mod_shout.c                | 2 +-
 src/mod/xml_int/mod_xml_cdr/mod_xml_cdr.c            | 2 +-
 src/switch_ivr.c                                     | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/mod/applications/mod_commands/mod_commands.c b/src/mod/applications/mod_commands/mod_commands.c
index 68cc58d10e..9b5455bac5 100644
--- a/src/mod/applications/mod_commands/mod_commands.c
+++ b/src/mod/applications/mod_commands/mod_commands.c
@@ -3045,7 +3045,7 @@ SWITCH_STANDARD_API(xml_wrap_api_function)
 
 		if (mystream.data) {
 			if (encoded) {
-				elen = (int) strlen(mystream.data) * 3;
+				elen = (int) strlen(mystream.data) * 3 + 1;
 				edata = malloc(elen);
 				switch_assert(edata != NULL);
 				memset(edata, 0, elen);
diff --git a/src/mod/applications/mod_conference/mod_conference.c b/src/mod/applications/mod_conference/mod_conference.c
index dc1995fbef..1bc220134d 100644
--- a/src/mod/applications/mod_conference/mod_conference.c
+++ b/src/mod/applications/mod_conference/mod_conference.c
@@ -3733,7 +3733,7 @@ static switch_status_t conf_api_sub_list(conference_obj_t *conference, switch_st
 
 static switch_xml_t add_x_tag(switch_xml_t x_member, const char *name, const char *value, int off)
 {
-	switch_size_t dlen = strlen(value) * 3;
+	switch_size_t dlen = strlen(value) * 3 + 1;
 	char *data;
 	switch_xml_t x_tag;
 
diff --git a/src/mod/applications/mod_voicemail/mod_voicemail.c b/src/mod/applications/mod_voicemail/mod_voicemail.c
index 069cfd8d9f..84e3ec4328 100644
--- a/src/mod/applications/mod_voicemail/mod_voicemail.c
+++ b/src/mod/applications/mod_voicemail/mod_voicemail.c
@@ -3678,7 +3678,7 @@ static int web_callback(void *pArg, int argc, char **argv, char **columnNames)
 	const char *fmt = "%a, %e %b %Y %T %z";
 	char heard[80];
 	char title_b4[128] = "";
-	char title_aft[128 * 3] = "";
+	char title_aft[128 * 3 + 1] = "";
 
 	if (argc > 0) {
 		l_created = switch_time_make(atol(argv[0]), 0);
diff --git a/src/mod/formats/mod_shout/mod_shout.c b/src/mod/formats/mod_shout/mod_shout.c
index d3fa2e8a45..97f20b867a 100644
--- a/src/mod/formats/mod_shout/mod_shout.c
+++ b/src/mod/formats/mod_shout/mod_shout.c
@@ -1100,7 +1100,7 @@ static int web_callback(void *pArg, int argc, char **argv, char **columnNames)
 {
 	struct holder *holder = (struct holder *) pArg;
 	char title_b4[128] = "";
-	char title_aft[128 * 3] = "";
+	char title_aft[128 * 3 + 1] = "";
 	char *mp3, *m3u;
 
 	/*
diff --git a/src/mod/xml_int/mod_xml_cdr/mod_xml_cdr.c b/src/mod/xml_int/mod_xml_cdr/mod_xml_cdr.c
index 83f9f72c09..84643dcd0b 100644
--- a/src/mod/xml_int/mod_xml_cdr/mod_xml_cdr.c
+++ b/src/mod/xml_int/mod_xml_cdr/mod_xml_cdr.c
@@ -264,7 +264,7 @@ static switch_status_t my_on_reporting(switch_core_session_t *session)
 		if (globals.encode == ENCODING_TEXTXML) {
 			headers = curl_slist_append(headers, "Content-Type: text/xml");
 		} else if (globals.encode) {
-			switch_size_t need_bytes = strlen(xml_text) * 3;
+			switch_size_t need_bytes = strlen(xml_text) * 3 + 1;
 
 			xml_text_escaped = malloc(need_bytes);
 			switch_assert(xml_text_escaped);
diff --git a/src/switch_ivr.c b/src/switch_ivr.c
index 6358eb4119..3d2a79c018 100644
--- a/src/switch_ivr.c
+++ b/src/switch_ivr.c
@@ -1841,7 +1841,7 @@ SWITCH_DECLARE(int) switch_ivr_set_xml_chan_vars(switch_xml_t xml, switch_channe
 	for (; hi; hi = hi->next) {
 		if (!zstr(hi->name) && !zstr(hi->value) && ((variable = switch_xml_add_child_d(xml, hi->name, off++)))) {
 			char *data;
-			switch_size_t dlen = strlen(hi->value) * 3;
+			switch_size_t dlen = strlen(hi->value) * 3 + 1;
 
 			if ((data = malloc(dlen))) {
 				memset(data, 0, dlen);