mirror of
https://github.com/asterisk/asterisk.git
synced 2025-09-18 18:58:22 +00:00
fix potential seg fault when using LEN() with a string greater than 80 characters (bug #4839)
git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/v1-0@6240 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
25
pbx.c
25
pbx.c
@@ -835,21 +835,22 @@ static void pbx_substitute_variables_temp(struct ast_channel *c, const char *var
|
||||
|
||||
if (c)
|
||||
headp=&c->varshead;
|
||||
|
||||
*ret=NULL;
|
||||
/* Now we have the variable name on cp3 */
|
||||
|
||||
if (!strncasecmp(var,"LEN(",4)) { /* ${LEN(<string>)} */
|
||||
int len=strlen(var);
|
||||
int len_len=4;
|
||||
if (strrchr(var,')')) {
|
||||
char cp3[80];
|
||||
strncpy(cp3, var, sizeof(cp3) - 1);
|
||||
cp3[len-len_len-1]='\0';
|
||||
sprintf(workspace,"%d",(int)strlen(cp3));
|
||||
*ret = workspace;
|
||||
} else {
|
||||
/* length is zero */
|
||||
*ret = "0";
|
||||
char *endparen, *string = ast_strdupa(var + 4);
|
||||
int len = 0;
|
||||
if (!string) {
|
||||
ast_log(LOG_WARNING, "Out of memory!\n");
|
||||
return;
|
||||
}
|
||||
if ((endparen = strrchr(string,')'))) {
|
||||
*endparen = '\0';
|
||||
len = strlen(string);
|
||||
}
|
||||
sprintf(workspace, "%d", len);
|
||||
*ret = workspace;
|
||||
} else if ((first=strchr(var,':'))) { /* : Remove characters counting from end or start of string */
|
||||
strncpy(tmpvar, var, sizeof(tmpvar) - 1);
|
||||
first = strchr(tmpvar, ':');
|
||||
|
Reference in New Issue
Block a user