check array bounds when parsing arguments to AGI (issue #5868)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.0@7558 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2005-12-20 20:23:20 +00:00
parent 0d1660a369
commit 168ed954eb

View File

@@ -1649,9 +1649,8 @@ static int agi_exec_full(struct ast_channel *chan, void *data, int enhanced, int
strncpy(buf, data, sizeof(buf) - 1); strncpy(buf, data, sizeof(buf) - 1);
memset(&agi, 0, sizeof(agi)); memset(&agi, 0, sizeof(agi));
while ((stringp = strsep(&tmp, "|"))) { while ((stringp = strsep(&tmp, "|")) && argc < MAX_ARGS - 1)
argv[argc++] = stringp; argv[argc++] = stringp;
}
argv[argc] = NULL; argv[argc] = NULL;
LOCAL_USER_ADD(u); LOCAL_USER_ADD(u);