ben.carrasco/freeswitch
1
0 Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-10-29 14:44:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Buffer overflow in switch_channel_expand_variables_check and switch_event_expand_headers_check fixed (FS-8757)

Browse Source
This commit is contained in:
Thomas Weber authored and Anthony Minessale committed 2016-04-19 11:44:35 -05:00
1 parent 1b9fda720a
commit 346e044daf
2 files changed
+32 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/switch_channel.c
+16 -3
View File
@@ -3883,6 +3883,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
p++;
continue;
} else if (*(p + 1) == '\\') {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p++;
len++;
continue;
@@ -3908,6 +3912,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
}
if (nv) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
nv = 0;
@@ -4103,11 +4111,12 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
vname = NULL;
br = 0;
}
if (len + 1 >= olen) {
resize(1);
}
if (sp) {
if (len + 1 >= olen) {
resize(1);
}
*c++ = ' ';
sp = 0;
len++;
@@ -4116,6 +4125,10 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables_check(switch_channel_t *c
if (*p == '$') {
p--;
} else {
if (len + 1 >= olen) {
resize(1);
}
*c++ = *p;
len++;
}