diff options
| author | jpeeler <jpeeler@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-06-18 19:28:24 +0000 |
|---|---|---|
| committer | jpeeler <jpeeler@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-06-18 19:28:24 +0000 |
| commit | 1b89e5a93d11f37798bc4787dae251f049f77832 (patch) | |
| tree | 92b8e2226514bc17cc2f469d50fdd0bdf41c3c07 | |
| parent | 38ef01a74a52346301f1c2e327ee69187a08a59c (diff) | |
Fix crash when parsing some heavily nested statements in AEL on reload.
Due to the recursion used when compiling AEL in gen_prios, all the stack space
was being consumed when parsing some AEL that contained nesting 13 levels deep.
Changing a few large buffers to be heap allocated fixed the crash, although I
did not test how many more levels can now be safely used.
(closes issue #16053)
Reported by: diLLec
Tested by: jpeeler
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@271399 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | pbx/pbx_ael.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/pbx/pbx_ael.c b/pbx/pbx_ael.c index d999caacc..31ab5db3a 100644 --- a/pbx/pbx_ael.c +++ b/pbx/pbx_ael.c @@ -3200,10 +3200,10 @@ static void gen_prios(struct ael_extension *exten, char *label, pval *statement, #ifdef OLD_RAND_ACTION struct ael_priority *rand_test, *rand_end, *rand_skip; #endif - char buf1[2000]; - char buf2[2000]; + char *buf1 = malloc(2000); + char *buf2 = malloc(2000); + char *new_label = malloc(2000); char *strp, *strp2; - char new_label[2000]; int default_exists; int local_control_statement_count; struct ael_priority *loop_break_save; @@ -4035,6 +4035,9 @@ static void gen_prios(struct ael_extension *exten, char *label, pval *statement, break; } } + free(buf1); + free(buf2); + free(new_label); } void set_priorities(struct ael_extension *exten) |