kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-20 03:26:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_http_websocket: read/write string fixup

Browse Source 
There was a problem when reading a string from the websocket. It assumed the
received data had a null terminator and tried to write the data to an ast_str.
This of course could/would read past the end of the given buffer while
writing the data to the internal buffer of ast_str. Modified the the code to
correctly place a null terminator on the result string.


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@416394 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Kevin Harwell
2014-06-16 16:22:33 +00:00
parent a1e0a5e4b0
commit bd0aa4fb04
3 changed files with 21 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
res/res_http_websocket.c
View File

@@ -497,7 +497,6 @@ int AST_OPTIONAL_API_NAME(ast_websocket_read)(struct ast_websocket *session, cha
if (ws_safe_read(session, (*payload), (*payload_len), opcode)) {
return 0;
}
/* If a mask is present unmask the payload */
if (mask_present) {
unsigned int pos;
@@ -1199,19 +1198,13 @@ struct ast_websocket *AST_OPTIONAL_API_NAME(ast_websocket_client_create)
}
int AST_OPTIONAL_API_NAME(ast_websocket_read_string)
(struct ast_websocket *ws, struct ast_str **buf)
(struct ast_websocket *ws, char **buf)
{
char *payload;
uint64_t payload_len;
enum ast_websocket_opcode opcode;
int fragmented = 1;
if (!*buf && !(*buf = ast_str_create(512))) {
ast_log(LOG_ERROR, "Client Websocket string read - "
"Unable to allocate string buffer");
return -1;
}
while (fragmented) {
if (ast_websocket_read(ws, &payload, &payload_len,
&opcode, &fragmented)) {
@@ -1220,6 +1213,10 @@ int AST_OPTIONAL_API_NAME(ast_websocket_read_string)
return -1;
}
if (opcode == AST_WEBSOCKET_OPCODE_CONTINUATION) {
continue;
}
if (opcode == AST_WEBSOCKET_OPCODE_CLOSE) {
return -1;
}
@@ -1229,17 +1226,21 @@ int AST_OPTIONAL_API_NAME(ast_websocket_read_string)
"non string data received\n");
return -1;
}
ast_str_append(buf, 0, "%s", payload);
}
return ast_str_size(*buf);
if (!(*buf = ast_malloc(payload_len + 1))) {
return -1;
}
ast_copy_string(*buf, payload, payload_len + 1);
return payload_len + 1;
}
int AST_OPTIONAL_API_NAME(ast_websocket_write_string)
(struct ast_websocket *ws, const struct ast_str *buf)
(struct ast_websocket *ws, const char *buf)
{
return ast_websocket_write(ws, AST_WEBSOCKET_OPCODE_TEXT,
ast_str_buffer(buf), ast_str_strlen(buf));
(char *)buf, strlen(buf));
}
static int load_module(void)