mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-08-19 09:40:21 +00:00
The positive-offset branch of `${variable:offset}` expansion advanced
`sub_val` past the cloned heap buffer without bounds-checking `offset`
against `strlen(sub_val)`. Subsequent `strlen()` and `strcat()` then
read adjacent heap memory into the output buffer.
FreeSWITCH unit tests should be kept as shallow unit tests and micro benchmarks testing functionality exposed through libfreeswitch. Requirements for a new unit tests: 1. Tests must use switch_test.h framework