aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b>2008-08-15 14:51:12 +0000
committertilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b>2008-08-15 14:51:12 +0000
commit223ce289ccdbc76a182e932f81c0045187dd2480 (patch)
tree186b9c8e644bd09d11022d4b3af1657420cde3fb
parentbafa88f1d8425b8a74e0d2968509bb92c575a5ff (diff)
Additional check for more string specifiers than arguments.
(closes issue #13299) Reported by: adomjan Patches: 20080813__bug13299.diff.txt uploaded by Corydon76 (license 14) func_strings.c-sprintf.patch uploaded by adomjan (license 487) Tested by: adomjan git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@138023 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r--funcs/func_strings.c19
1 files changed, 15 insertions, 4 deletions
diff --git a/funcs/func_strings.c b/funcs/func_strings.c
index 10c274efd..793b016b1 100644
--- a/funcs/func_strings.c
+++ b/funcs/func_strings.c
@@ -300,8 +300,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
formatbuf[&arg.format[i] - formatstart + 1] = '\0';
/* Convert the argument into the required type */
- if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
- ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+ if (arg.var[argcount]) {
+ if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
+ ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+ goto sprintf_fail;
+ }
+ } else {
+ ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
goto sprintf_fail;
}
@@ -318,8 +323,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
formatbuf[&arg.format[i] - formatstart + 1] = '\0';
/* Convert the argument into the required type */
- if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
- ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+ if (arg.var[argcount]) {
+ if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
+ ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+ goto sprintf_fail;
+ }
+ } else {
+ ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
goto sprintf_fail;
}
@@ -366,6 +376,7 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
}
}
}
+ *bufptr = '\0';
return 0;
sprintf_fail:
return -1;