kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-18 15:49:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent crashes in res_xmpp when receiving large messages

Browse Source 
Similar to r378287, res_xmpp was marshaling data read from an external source
onto the stack. For a sufficiently large message, this could cause a stack
overflow. This patch modifies res_xmpp in a similar fashion to res_jabber by
removing the stack allocation, as it was unnecessary.

(issue ASTERISK-20658)
Reported by: wdoekes

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@378409 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Matthew Jordan
2013-01-03 15:36:05 +00:00
parent 7eb9a846d8
commit 3778ed7fc1
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
res/res_xmpp.c
View File

@@ -1832,7 +1832,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch
{ {
RAII_VAR(struct xmpp_config *, cfg, ao2_global_obj_ref(globals), ao2_cleanup); RAII_VAR(struct xmpp_config *, cfg, ao2_global_obj_ref(globals), ao2_cleanup);
RAII_VAR(struct ast_xmpp_client_config *, clientcfg, NULL, ao2_cleanup); RAII_VAR(struct ast_xmpp_client_config *, clientcfg, NULL, ao2_cleanup);
char *aux = NULL, *parse = NULL; char *parse = NULL;
int timeout, jidlen, resourcelen, found = 0; int timeout, jidlen, resourcelen, found = 0;
struct timeval start; struct timeval start;
long diff = 0; long diff = 0;
@@ -1946,7 +1946,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch
continue; continue;
} }
found = 1; found = 1;
aux = ast_strdupa(message->message); ast_copy_string(buf, message->message, buflen);
AST_LIST_REMOVE_CURRENT(list); AST_LIST_REMOVE_CURRENT(list);
xmpp_message_destroy(message); xmpp_message_destroy(message);
break; break;
@@ -1970,7 +1970,6 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch
ast_log(LOG_NOTICE, "Timed out : no message received from %s\n", args.jid); ast_log(LOG_NOTICE, "Timed out : no message received from %s\n", args.jid);
return -1; return -1;
} }
ast_copy_string(buf, aux, buflen);
return 0; return 0;
} }