From 281f88ae392bca574a8543468fafaca94de03b91 Mon Sep 17 00:00:00 2001 From: Mathieu Parent Date: Sat, 17 Dec 2011 21:04:11 +0100 Subject: [PATCH] Skinny: Don't do backspace if destination number is already empty This fix a out of bound memory write. (normally unreachable with a real phone) --- src/mod/endpoints/mod_skinny/skinny_server.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mod/endpoints/mod_skinny/skinny_server.c b/src/mod/endpoints/mod_skinny/skinny_server.c index 00ec6fa56b..8e47691c36 100644 --- a/src/mod/endpoints/mod_skinny/skinny_server.c +++ b/src/mod/endpoints/mod_skinny/skinny_server.c @@ -271,7 +271,7 @@ switch_status_t skinny_session_process_dest(switch_core_session_t *session, list if (strlen(tech_pvt->caller_profile->destination_number) == 0) {/* no digit yet */ send_start_tone(listener, SKINNY_TONE_DIALTONE, 0, line_instance, tech_pvt->call_id); } - if (backspace) { /* backspace */ + if (backspace && strlen(tech_pvt->caller_profile->destination_number)) { /* backspace */ tech_pvt->caller_profile->destination_number[strlen(tech_pvt->caller_profile->destination_number)-1] = '\0'; if (strlen(tech_pvt->caller_profile->destination_number) == 0) { send_select_soft_keys(listener, line_instance, tech_pvt->call_id, SKINNY_KEY_SET_OFF_HOOK, 0xffff);