kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Buffer overflow in switch_channel_expand_variables_check and switch_event_expand_headers_check fixed (FS-8757)

This commit is contained in:
Thomas Weber 2016-01-19 14:50:38 +01:00
parent 5258338429
commit 28da36e3e0
2 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/switch_channel.c
View File

@ -3825,6 +3825,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
p++;
continue;
} else if (*(p + 1) == '\\') {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p++;
len++;
continue;
@ -3850,6 +3854,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
}
if (nv) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
nv = 0;
@ -4045,11 +4053,12 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
vname = NULL;
br = 0;
}
if (len + 1 >= olen) {
resize(1);
}
if (sp) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = ' ';
sp = 0;
len++;
@ -4058,6 +4067,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
if (*p == '$') {
p--;
} else {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
}

19
src/switch_event.c
View File

@ -2240,6 +2240,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
p++;
continue;
} else if (*(p + 1) == '\\') {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p++;
len++;
continue;
@ -2264,6 +2268,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
}
if (nv) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
nv = 0;
@ -2464,11 +2472,12 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
vtype = 0;
br = 0;
}
if (len + 1 >= olen) {
resize(1);
}
if (sp) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = ' ';
sp = 0;
len++;
@ -2477,6 +2486,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
if (*p == '$') {
p--;
} else {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
}