mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-11-13 04:57:05 +00:00
Dmitry Verenitsin
30cdb387ae
The positive-offset branch of `${variable:offset}` expansion advanced
`sub_val` past the cloned heap buffer without bounds-checking `offset`
against `strlen(sub_val)`. Subsequent `strlen()` and `strcat()` then
read adjacent heap memory into the output buffer.