fix bounds checking (bug #4406)

git-svn-id: http://svn.digium.com/svn/asterisk/branches/v1-0@5911 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 26 insertions, 33 deletions

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index f255cdd4c..9e897bc58 100755
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -2234,8 +2234,10 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
 			}
             if ((p->dtmfmode & SIP_DTMF_INBAND) && p->vad) {
                    f = ast_dsp_process(p->owner,p->vad,f);
-		   if (f && (f->frametype == AST_FRAME_DTMF)) 
+		   if (f && (f->frametype == AST_FRAME_DTMF)) {
 			ast_log(LOG_DEBUG, "Detected DTMF '%c'\n", f->subclass);
+			ast_log(LOG_NOTICE, "Detected inband DTMF '%c'\n", f->subclass);
+		   }
             }
 		}
 	}
@@ -2821,54 +2823,52 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req)
 /*--- add_header: Add header to SIP message */
 static int add_header(struct sip_request *req, char *var, char *value)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+	if (req->headers == SIP_MAX_HEADERS) {
+		ast_log(LOG_WARNING, "Out of SIP header space\n");
 		return -1;
 	}
 	if (req->lines) {
 		ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
 		return -1;
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+		return -1;
+	}
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len - 4, "%s: %s\r\n", var, value);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else {
-		ast_log(LOG_WARNING, "Out of header space\n");
-		return -1;
-	}
+	req->headers++;
 	return 0;	
 }
 
 /*--- add_blank_header: Add blank header to SIP message */
 static int add_blank_header(struct sip_request *req)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+	if (req->headers == SIP_MAX_HEADERS)  {
+		ast_log(LOG_WARNING, "Out of SIP header space\n");
 		return -1;
 	}
 	if (req->lines) {
 		ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
 		return -1;
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+		return -1;
+	}
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "\r\n");
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else {
-		ast_log(LOG_WARNING, "Out of header space\n");
-		return -1;
-	}
+	req->headers++;
 	return 0;	
 }
 
 /*--- add_line: Add content (not header) to SIP message */
 static int add_line(struct sip_request *req, char *line)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+	if (req->lines == SIP_MAX_LINES) {
+		ast_log(LOG_WARNING, "Out of line space\n");
 		return -1;
 	}
 	if (!req->lines) {
@@ -2876,15 +2876,14 @@ static int add_line(struct sip_request *req, char *line)
 		snprintf(req->data + req->len, sizeof(req->data) - req->len, "\r\n");
 		req->len += strlen(req->data + req->len);
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+		return -1;
+	}
 	req->line[req->lines] = req->data + req->len;
 	snprintf(req->line[req->lines], sizeof(req->data) - req->len, "%s", line);
 	req->len += strlen(req->line[req->lines]);
-	if (req->lines < SIP_MAX_LINES)
-		req->lines++;
-	else {
-		ast_log(LOG_WARNING, "Out of line space\n");
-		return -1;
-	}
+	req->lines++;
 	return 0;	
 }
 
@@ -3060,10 +3059,7 @@ static int init_resp(struct sip_request *req, char *resp, struct sip_request *or
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "SIP/2.0 %s\r\n", resp);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else
-		ast_log(LOG_WARNING, "Out of header space\n");
+	req->headers++;
 	return 0;
 }
 
@@ -3078,10 +3074,7 @@ static int init_req(struct sip_request *req, char *resp, char *recip)
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "%s %s SIP/2.0\r\n", resp, recip);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else
-		ast_log(LOG_WARNING, "Out of header space\n");
+	req->headers++;
 	return 0;
 }