diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-03-07 06:36:33 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-03-07 06:36:33 +0000 |
commit | 2d66183adf20c8b3898a3bfc97627d55dff7891f (patch) | |
tree | e1d83f46856427c7e9df46336f418ec059a92c57 | |
parent | 6623be8860eb9337ebbc3a5a32388270fac5628b (diff) |
Safely use the strncat() function.
(closes issue #11958)
Reported by: norman
Patches:
20080209__bug11958.diff.txt uploaded by Corydon76 (license 14)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@106552 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r-- | apps/app_chanspy.c | 2 | ||||
-rw-r--r-- | apps/app_rpt.c | 6 | ||||
-rw-r--r-- | apps/app_speech_utils.c | 2 | ||||
-rw-r--r-- | apps/app_voicemail.c | 4 | ||||
-rw-r--r-- | channels/chan_misdn.c | 15 | ||||
-rw-r--r-- | funcs/func_enum.c | 2 | ||||
-rw-r--r-- | main/asterisk.c | 5 | ||||
-rw-r--r-- | main/channel.c | 4 | ||||
-rw-r--r-- | main/frame.c | 6 | ||||
-rw-r--r-- | main/manager.c | 4 |
10 files changed, 23 insertions, 27 deletions
diff --git a/apps/app_chanspy.c b/apps/app_chanspy.c index a1e54ca44..eb093e09f 100644 --- a/apps/app_chanspy.c +++ b/apps/app_chanspy.c @@ -579,7 +579,7 @@ static int common_exec(struct ast_channel *chan, const struct ast_flags *flags, } strcpy(peer_name, "spy-"); - strncat(peer_name, peer->name, AST_NAME_STRLEN); + strncat(peer_name, peer->name, AST_NAME_STRLEN - 4 - 1); ptr = strchr(peer_name, '/'); *ptr++ = '\0'; diff --git a/apps/app_rpt.c b/apps/app_rpt.c index e7f7b003c..292dfc6f6 100644 --- a/apps/app_rpt.c +++ b/apps/app_rpt.c @@ -2427,7 +2427,7 @@ static int rpt_do_fun(int fd, int argc, char *argv[]) } if(!busy){ myrpt->macrotimer = MACROTIME; - strncat(myrpt->macrobuf,argv[3],MAXMACRO - 1); + strncat(myrpt->macrobuf, argv[3], MAXMACRO - strlen(myrpt->macrobuf) - 1); } rpt_mutex_unlock(&myrpt->lock); } @@ -5090,7 +5090,7 @@ int i; return DC_ERROR; } myrpt->macrotimer = MACROTIME; - strncat(myrpt->macrobuf,val,MAXMACRO - 1); + strncat(myrpt->macrobuf, val, MAXMACRO - strlen(myrpt->macrobuf) - 1); rpt_mutex_unlock(&myrpt->lock); return DC_COMPLETE; } @@ -8749,7 +8749,7 @@ static void do_scheduler(struct rpt *myrpt) return; /* Macro buffer full */ } myrpt->macrotimer = MACROTIME; - strncat(myrpt->macrobuf,val,MAXMACRO - 1); + strncat(myrpt->macrobuf,val,MAXMACRO - strlen(myrpt->macrobuf) - 1); } else{ ast_log(LOG_WARNING,"Malformed scheduler entry in rpt.conf: %s = %s\n", diff --git a/apps/app_speech_utils.c b/apps/app_speech_utils.c index e45459166..64d0f1bc4 100644 --- a/apps/app_speech_utils.c +++ b/apps/app_speech_utils.c @@ -735,7 +735,7 @@ static int speech_background(struct ast_channel *chan, void *data) } time(&start); snprintf(tmp, sizeof(tmp), "%c", f->subclass); - strncat(dtmf, tmp, sizeof(dtmf)); + strncat(dtmf, tmp, sizeof(dtmf) - strlen(dtmf) - 1); /* If the maximum length of the DTMF has been reached, stop now */ if (max_dtmf_len && strlen(dtmf) == max_dtmf_len) done = 1; diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c index 74bfd2c9a..79e8bf2ea 100644 --- a/apps/app_voicemail.c +++ b/apps/app_voicemail.c @@ -3842,8 +3842,8 @@ static int vm_forwardoptions(struct ast_channel *chan, struct ast_vm_user *vmu, make_file(msgfile, sizeof(msgfile), curdir, curmsg); strcpy(textfile, msgfile); strcpy(backup, msgfile); - strncat(textfile, ".txt", sizeof(textfile) - 1); - strncat(backup, "-bak", sizeof(backup) - 1); + strncat(textfile, ".txt", sizeof(textfile) - strlen(textfile) - 1); + strncat(backup, "-bak", sizeof(backup) - strlen(backup) - 1); if (!(msg_cfg = ast_config_load(textfile))) { return -1; diff --git a/channels/chan_misdn.c b/channels/chan_misdn.c index 47505dfdd..c70c45938 100644 --- a/channels/chan_misdn.c +++ b/channels/chan_misdn.c @@ -2246,8 +2246,7 @@ static int misdn_digit_end(struct ast_channel *ast, char digit, unsigned int dur buf[1]=0; l = sizeof(bc->infos_pending); - strncat(bc->infos_pending,buf,l); - bc->infos_pending[l-1] = 0; + strncat(bc->infos_pending, buf, l - strlen(bc->infos_pending) - 1); } break; case MISDN_CALLING_ACKNOWLEDGE: @@ -2257,8 +2256,7 @@ static int misdn_digit_end(struct ast_channel *ast, char digit, unsigned int dur { int l = sizeof(bc->dad); - strncat(bc->dad,bc->info_dad, l - strlen(bc->dad)); - bc->dad[l-1] = 0; + strncat(bc->dad, bc->info_dad, l - strlen(bc->dad) - 1); } { int l = sizeof(p->ast->exten); @@ -4054,8 +4052,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data) } l = sizeof(bc->dad); - strncat(bc->dad,bc->info_dad, l); - bc->dad[l-1] = 0; + strncat(bc->dad,bc->info_dad, l - strlen(bc->dad) - 1); l = sizeof(ch->ast->exten); strncpy(ch->ast->exten, bc->dad, l); @@ -4133,8 +4130,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data) if (ch->state != MISDN_CONNECTED ) { if (digits) { int l = sizeof(bc->dad); - strncat(bc->dad,bc->info_dad, l); - bc->dad[l-1] = 0; + strncat(bc->dad, bc->info_dad, l - strlen(bc->dad) - 1); l = sizeof(ch->ast->exten); strncpy(ch->ast->exten, bc->dad, l); ch->ast->exten[l-1] = 0; @@ -4436,8 +4432,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data) { int l = sizeof(bc->dad); - strncat(bc->dad,bc->infos_pending, l - strlen(bc->dad)); - bc->dad[l-1] = 0; + strncat(bc->dad, bc->infos_pending, l - strlen(bc->dad) - 1); } if (!ch->ast) break; diff --git a/funcs/func_enum.c b/funcs/func_enum.c index 43e953c3b..554937908 100644 --- a/funcs/func_enum.c +++ b/funcs/func_enum.c @@ -98,7 +98,7 @@ static int function_enum(struct ast_channel *chan, char *cmd, char *data, for (s = p = args.number; *s; s++) { if (*s != '-') { snprintf(tmp, sizeof(tmp), "%c", *s); - strncat(num, tmp, sizeof(num)); + strncat(num, tmp, sizeof(num) - strlen(num) - 1); } } diff --git a/main/asterisk.c b/main/asterisk.c index 51423bf55..77d1489ff 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -1932,9 +1932,10 @@ static char *cli_prompt(EditLine *el) if (color_used) { /* Force colors back to normal at end */ term_color_code(term_code, COLOR_WHITE, COLOR_BLACK, sizeof(term_code)); - if (strlen(term_code) > sizeof(prompt) - strlen(prompt)) { - strncat(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code)); + if (strlen(term_code) > sizeof(prompt) - strlen(prompt) - 1) { + ast_copy_string(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code) + 1); } else { + /* This looks wrong, but we've already checked the length of term_code to ensure it's safe */ strncat(p, term_code, sizeof(term_code)); } } diff --git a/main/channel.c b/main/channel.c index 73c7db603..febebc515 100644 --- a/main/channel.c +++ b/main/channel.c @@ -4373,12 +4373,12 @@ char *ast_print_group(char *buf, int buflen, ast_group_t group) for (i = 0; i <= 63; i++) { /* Max group is 63 */ if (group & ((ast_group_t) 1 << i)) { if (!first) { - strncat(buf, ", ", buflen); + strncat(buf, ", ", buflen - strlen(buf) - 1); } else { first=0; } snprintf(num, sizeof(num), "%u", i); - strncat(buf, num, buflen); + strncat(buf, num, buflen - strlen(buf) - 1); } } return buf; diff --git a/main/frame.c b/main/frame.c index 1dafce9f8..fa54e6772 100644 --- a/main/frame.c +++ b/main/frame.c @@ -1091,16 +1091,16 @@ int ast_codec_pref_string(struct ast_codec_pref *pref, char *buf, size_t size) slen = strlen(formatname); if(slen > total_len) break; - strncat(buf,formatname,total_len); + strncat(buf, formatname, total_len - 1); /* safe */ total_len -= slen; } if(total_len && x < 31 && ast_codec_pref_index(pref , x + 1)) { - strncat(buf,"|",total_len); + strncat(buf, "|", total_len - 1); /* safe */ total_len--; } } if(total_len) { - strncat(buf,")",total_len); + strncat(buf, ")", total_len - 1); /* safe */ total_len--; } diff --git a/main/manager.c b/main/manager.c index b78ecf5e3..4fadb744c 100644 --- a/main/manager.c +++ b/main/manager.c @@ -206,10 +206,10 @@ static char *authority_to_str(int authority, char *res, int reslen) for (i = 0; i < (sizeof(perms) / sizeof(perms[0])) - 1; i++) { if (authority & perms[i].num) { if (*res) { - strncat(res, ",", (reslen > running_total) ? reslen - running_total : 0); + strncat(res, ",", (reslen > running_total) ? reslen - running_total - 1 : 0); running_total++; } - strncat(res, perms[i].label, (reslen > running_total) ? reslen - running_total : 0); + strncat(res, perms[i].label, (reslen > running_total) ? reslen - running_total - 1 : 0); running_total += strlen(perms[i].label); } } |