kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

[mod_dialplan_xml] Fix possible use after free in parse_exten()

This commit is contained in:
Andrey Volk 2021-04-06 19:43:57 +03:00
parent bb150bc486
commit 322191a2f4
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/mod/dialplans/mod_dialplan_xml/mod_dialplan_xml.c
View File

@ -361,6 +361,7 @@ static int parse_exten(switch_core_session_t *session, switch_caller_profile_t *
switch_regex_safe_free(re); switch_regex_safe_free(re);
switch_safe_free(field_expanded); switch_safe_free(field_expanded);
if (expression == expression_expanded) expression = NULL;
switch_safe_free(expression_expanded); switch_safe_free(expression_expanded);
} }
@ -375,6 +376,7 @@ static int parse_exten(switch_core_session_t *session, switch_caller_profile_t *
} }
switch_safe_free(field_expanded); switch_safe_free(field_expanded);
if (expression == expression_expanded) expression = NULL;
switch_safe_free(expression_expanded); switch_safe_free(expression_expanded);
} else { } else {
if ((xexpression = switch_xml_child(xcond, "expression"))) { if ((xexpression = switch_xml_child(xcond, "expression"))) {
@ -502,7 +504,7 @@ static int parse_exten(switch_core_session_t *session, switch_caller_profile_t *
proceed = 1; proceed = 1;
} }
} else { } else {
if (field && strchr(expression, '(')) { if (field && expression && strchr(expression, '(')) {
switch_channel_set_variable(channel, "DP_MATCH", NULL); switch_channel_set_variable(channel, "DP_MATCH", NULL);
switch_capture_regex(re, proceed, field_data, ovector, "DP_MATCH", switch_regex_set_var_callback, session); switch_capture_regex(re, proceed, field_data, ovector, "DP_MATCH", switch_regex_set_var_callback, session);
} }
@ -524,7 +526,7 @@ static int parse_exten(switch_core_session_t *session, switch_caller_profile_t *
data = (char *) switch_xml_attr_soft(xaction, "data"); data = (char *) switch_xml_attr_soft(xaction, "data");
} }
if (field && strchr(expression, '(')) { if (field && expression && strchr(expression, '(')) {
len = (uint32_t) (strlen(data) + strlen(field_data) + 10) * proceed; len = (uint32_t) (strlen(data) + strlen(field_data) + 10) * proceed;
if (!(substituted = malloc(len))) { if (!(substituted = malloc(len))) {
switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "Memory Error!\n"); switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "Memory Error!\n");