kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-18 18:58:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Resolve an invalid memory read on an event.

Browse Source 
Valgrind pointed out that attempting to get an IE value from an event that has
no IEs produces an invalid memory read past the end of the event.  Thanks to
mmichelson for pointing the problem out to me and then testing the fix.


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@269417 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2010-06-09 21:11:43 +00:00
parent 9aafd4c6b1
commit 05c46771ca
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
main/event.c
View File

@@ -935,11 +935,20 @@ struct ast_event_sub *ast_event_unsubscribe(struct ast_event_sub *sub)
return NULL;
}
void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
int ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
{
int res = 0;
iterator->event_len = ast_event_get_size(event);
iterator->event = event;
iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
if (iterator->event_len >= sizeof(*event) + sizeof(struct ast_event_ie)) {
iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
} else {
iterator->ie = NULL;
res = -1;
}
return res;
}
int ast_event_iterator_next(struct ast_event_iterator *iterator)
@@ -1021,9 +1030,9 @@ const char *ast_event_get_ie_str(const struct ast_event *event, enum ast_event_i
const void *ast_event_get_ie_raw(const struct ast_event *event, enum ast_event_ie_type ie_type)
{
struct ast_event_iterator iterator;
int res = 0;
int res;
for (ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
for (res = ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
if (ast_event_iterator_get_ie_type(&iterator) == ie_type) {
return ast_event_iterator_get_ie_raw(&iterator);
}