diff options
| author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-08-15 15:04:14 +0000 |
|---|---|---|
| committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-08-15 15:04:14 +0000 |
| commit | 54c90a0775297896ea4fb8320b966cf5c9c58399 (patch) | |
| tree | 2e7b8516c13c07ee83249faad0970fabb316eafb | |
| parent | b468522b4180e1474e41c057dce0a82ff1f0ee50 (diff) | |
Merged revisions 138024 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk
................
r138024 | tilghman | 2008-08-15 10:03:32 -0500 (Fri, 15 Aug 2008) | 16 lines
Merged revisions 138023 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r138023 | tilghman | 2008-08-15 09:51:12 -0500 (Fri, 15 Aug 2008) | 8 lines
Additional check for more string specifiers than arguments.
(closes issue #13299)
Reported by: adomjan
Patches:
20080813__bug13299.diff.txt uploaded by Corydon76 (license 14)
func_strings.c-sprintf.patch uploaded by adomjan (license 487)
Tested by: adomjan
........
................
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.0@138025 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | funcs/func_strings.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/funcs/func_strings.c b/funcs/func_strings.c index f50ea245d..8784adb36 100644 --- a/funcs/func_strings.c +++ b/funcs/func_strings.c @@ -496,8 +496,13 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch formatbuf[&arg.format[i] - formatstart + 1] = '\0'; /* Convert the argument into the required type */ - if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) { - ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf); + if (arg.var[argcount]) { + if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) { + ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf); + goto sprintf_fail; + } + } else { + ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n"); goto sprintf_fail; } @@ -514,8 +519,13 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch formatbuf[&arg.format[i] - formatstart + 1] = '\0'; /* Convert the argument into the required type */ - if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) { - ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf); + if (arg.var[argcount]) { + if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) { + ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf); + goto sprintf_fail; + } + } else { + ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n"); goto sprintf_fail; } @@ -562,6 +572,7 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch } } } + *bufptr = '\0'; return 0; sprintf_fail: return -1; |