From 18a7339d8a9e24d99e7b595186587caac4a69dc1 Mon Sep 17 00:00:00 2001
From: Anthony Minessale <anthony.minessale@gmail.com>
Date: Mon, 25 Sep 2006 20:04:40 +0000
Subject: [PATCH] remove potential buffer overrun

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@2833 d0543943-73ff-0310-b7d9-9358b9ac24b2
---
 .../mod_event_socket/mod_event_socket.c            | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/mod/event_handlers/mod_event_socket/mod_event_socket.c b/src/mod/event_handlers/mod_event_socket/mod_event_socket.c
index 7134ac3882..b2cf475776 100644
--- a/src/mod/event_handlers/mod_event_socket/mod_event_socket.c
+++ b/src/mod/event_handlers/mod_event_socket/mod_event_socket.c
@@ -228,7 +228,7 @@ static void strip_cr(char *s)
 static switch_status_t read_packet(listener_t *listener, switch_event_t **event, uint32_t timeout) 
 {
 	switch_size_t mlen;
-	char mbuf[1024] = "";
+	char mbuf[2048] = "";
 	char buf[1024] = "";
 	switch_size_t len;
 	switch_status_t status = SWITCH_STATUS_SUCCESS;
@@ -238,7 +238,7 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
 	void *pop;
 	char *ptr;
 	uint8_t crcount = 0;
-
+	uint32_t max_len = sizeof(mbuf);
 	*event = NULL;
 	start = time(NULL);
 	ptr = mbuf;
@@ -253,12 +253,13 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
 		}
 
 		if (mlen) {
-			bytes++;
+			bytes += mlen;
 			do_sleep = 0;
 
 			if (*mbuf == '\r' || *mbuf == '\n') { /* bah */
 				ptr = mbuf;
 				mbuf[0] = '\0';
+				bytes = 0;
 				continue;
 			}
 
@@ -268,10 +269,15 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
 				crcount = 0;
 			}
 			ptr++;
+
+			if (bytes >= max_len) {
+				crcount = 2;
+			}
+
 			if (crcount == 2) {
 				char *next;
 				char *cur = mbuf;
-
+				bytes = 0;
 				while(cur) {
 					if ((next = strchr(cur, '\r')) || (next = strchr(cur, '\n'))) {
 						while (*next == '\r' || *next == '\n') {