kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

remove potential buffer overrun 

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@2833 d0543943-73ff-0310-b7d9-9358b9ac24b2
This commit is contained in:
Anthony Minessale 2006-09-25 20:04:40 +00:00
parent 08fbc8be3c
commit 18a7339d8a
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/mod/event_handlers/mod_event_socket/mod_event_socket.c
View File

@ -228,7 +228,7 @@ static void strip_cr(char *s)
static switch_status_t read_packet(listener_t *listener, switch_event_t **event, uint32_t timeout) static switch_status_t read_packet(listener_t *listener, switch_event_t **event, uint32_t timeout)
{ {
switch_size_t mlen; switch_size_t mlen;
char mbuf[1024] = ""; char mbuf[2048] = "";
char buf[1024] = ""; char buf[1024] = "";
switch_size_t len; switch_size_t len;
switch_status_t status = SWITCH_STATUS_SUCCESS; switch_status_t status = SWITCH_STATUS_SUCCESS;
@ -238,7 +238,7 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
void *pop; void *pop;
char *ptr; char *ptr;
uint8_t crcount = 0; uint8_t crcount = 0;
uint32_t max_len = sizeof(mbuf);
*event = NULL; *event = NULL;
start = time(NULL); start = time(NULL);
ptr = mbuf; ptr = mbuf;
@ -253,12 +253,13 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
} }
if (mlen) { if (mlen) {
bytes++; bytes += mlen;
do_sleep = 0; do_sleep = 0;
if (*mbuf == '\r' || *mbuf == '\n') { /* bah */ if (*mbuf == '\r' || *mbuf == '\n') { /* bah */
ptr = mbuf; ptr = mbuf;
mbuf[0] = '\0'; mbuf[0] = '\0';
bytes = 0;
continue; continue;
} }
@ -268,10 +269,15 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event,
crcount = 0; crcount = 0;
} }
ptr++; ptr++;
if (bytes >= max_len) {
crcount = 2;
}
if (crcount == 2) { if (crcount == 2) {
char *next; char *next;
char *cur = mbuf; char *cur = mbuf;
bytes = 0;
while(cur) { while(cur) {
if ((next = strchr(cur, '\r')) || (next = strchr(cur, '\n'))) { if ((next = strchr(cur, '\r')) || (next = strchr(cur, '\n'))) {
while (*next == '\r' || *next == '\n') { while (*next == '\r' || *next == '\n') {