kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #672 in FS/freeswitch from ~WT123/freeswitch:bugfix/FS-8757-fix-variable-and-header-expansion-buffer-overflow to v1.4 

* commit '28da36e3e004b37584acaa28e99c674bfa39842a':
  Buffer overflow in switch_channel_expand_variables_check and switch_event_expand_headers_check fixed (FS-8757)
This commit is contained in:
Anthony Minessale II 2016-01-19 10:38:08 -06:00
parent 5258338429 28da36e3e0
commit c1a3a280c2
2 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/switch_channel.c
View File

@ -3825,6 +3825,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
p++; p++;
continue; continue;
} else if (*(p + 1) == '\\') { } else if (*(p + 1) == '\\') {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p++; *c++ = *p++;
len++; len++;
continue; continue;
@ -3850,6 +3854,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
} }
if (nv) { if (nv) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p; *c++ = *p;
len++; len++;
nv = 0; nv = 0;
@ -4045,11 +4053,12 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
vname = NULL; vname = NULL;
br = 0; br = 0;
} }
if (len + 1 >= olen) {
resize(1);
}
if (sp) { if (sp) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = ' '; *c++ = ' ';
sp = 0; sp = 0;
len++; len++;
@ -4058,6 +4067,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
if (*p == '$') { if (*p == '$') {
p--; p--;
} else { } else {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p; *c++ = *p;
len++; len++;
} }

19
src/switch_event.c
View File

@ -2240,6 +2240,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
p++; p++;
continue; continue;
} else if (*(p + 1) == '\\') { } else if (*(p + 1) == '\\') {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p++; *c++ = *p++;
len++; len++;
continue; continue;
@ -2264,6 +2268,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
} }
if (nv) { if (nv) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p; *c++ = *p;
len++; len++;
nv = 0; nv = 0;
@ -2464,11 +2472,12 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
vtype = 0; vtype = 0;
br = 0; br = 0;
} }
if (len + 1 >= olen) {
resize(1);
}
if (sp) { if (sp) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = ' '; *c++ = ' ';
sp = 0; sp = 0;
len++; len++;
@ -2477,6 +2486,10 @@ SWITCH_DECLARE(char *) switch_event_expand_headers_check(switch_event_t *event,
if (*p == '$') { if (*p == '$') {
p--; p--;
} else { } else {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p; *c++ = *p;
len++; len++;
} }