AST-2009-005

git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@211528 f38db490-d61c-443f-a65b-d21fe96a405b

5 files changed, 13 insertions, 13 deletions

diff --git a/funcs/func_channel.c b/funcs/func_channel.c
index d2e5c2c67..99f6d1e61 100644
--- a/funcs/func_channel.c
+++ b/funcs/func_channel.c
@@ -116,10 +116,10 @@ static int func_channel_write(struct ast_channel *chan, char *function,
 	} else if (!strcasecmp(data, "callgroup"))
 		chan->callgroup = ast_get_group(value);
 	else if (!strcasecmp(data, "txgain")) {
-		sscanf(value, "%hhd", &gainset);
+		sscanf(value, "%4hhd", &gainset);
 		ast_channel_setoption(chan, AST_OPTION_TXGAIN, &gainset, sizeof(gainset), 0);
 	} else if (!strcasecmp(data, "rxgain")) {
-		sscanf(value, "%hhd", &gainset);
+		sscanf(value, "%4hhd", &gainset);
 		ast_channel_setoption(chan, AST_OPTION_RXGAIN, &gainset, sizeof(gainset), 0);
 	} else if (!strcasecmp(data, "transfercapability")) {
 		unsigned short i;
diff --git a/funcs/func_cut.c b/funcs/func_cut.c
index 66f464dd6..9e95092ac 100644
--- a/funcs/func_cut.c
+++ b/funcs/func_cut.c
@@ -96,7 +96,7 @@ static int sort_internal(struct ast_channel *chan, char *data, char *buffer, siz
 		}
 		*ptrvalue++ = '\0';
 		sortable_keys[count2].key = ptrkey;
-		sscanf(ptrvalue, "%f", &sortable_keys[count2].value);
+		sscanf(ptrvalue, "%30f", &sortable_keys[count2].value);
 		count2++;
 	}
 
@@ -173,15 +173,15 @@ static int cut_internal(struct ast_channel *chan, char *data, char *buffer, size
 				int num1 = 0, num2 = MAXRESULT;
 				char trashchar;
 
-				if (sscanf(nextgroup, "%d-%d", &num1, &num2) == 2) {
+				if (sscanf(nextgroup, "%30d-%30d", &num1, &num2) == 2) {
 					/* range with both start and end */
-				} else if (sscanf(nextgroup, "-%d", &num2) == 1) {
+				} else if (sscanf(nextgroup, "-%30d", &num2) == 1) {
 					/* range with end */
 					num1 = 0;
-				} else if ((sscanf(nextgroup, "%d%c", &num1, &trashchar) == 2) && (trashchar == '-')) {
+				} else if ((sscanf(nextgroup, "%30d%1c", &num1, &trashchar) == 2) && (trashchar == '-')) {
 					/* range with start */
 					num2 = MAXRESULT;
-				} else if (sscanf(nextgroup, "%d", &num1) == 1) {
+				} else if (sscanf(nextgroup, "%30d", &num1) == 1) {
 					/* single number */
 					num2 = num1;
 				} else {
diff --git a/funcs/func_math.c b/funcs/func_math.c
index edded7575..76d9deff6 100644
--- a/funcs/func_math.c
+++ b/funcs/func_math.c
@@ -165,12 +165,12 @@ static int math(struct ast_channel *chan, char *cmd, char *parse,
 		return -1;
 	}
 
-	if (sscanf(mvalue1, "%lf", &fnum1) != 1) {
+	if (sscanf(mvalue1, "%30lf", &fnum1) != 1) {
 		ast_log(LOG_WARNING, "'%s' is not a valid number\n", mvalue1);
 		return -1;
 	}
 
-	if (sscanf(mvalue2, "%lf", &fnum2) != 1) {
+	if (sscanf(mvalue2, "%30lf", &fnum2) != 1) {
 		ast_log(LOG_WARNING, "'%s' is not a valid number\n", mvalue2);
 		return -1;
 	}
diff --git a/funcs/func_rand.c b/funcs/func_rand.c
index 53952d341..ea6d7d393 100644
--- a/funcs/func_rand.c
+++ b/funcs/func_rand.c
@@ -53,10 +53,10 @@ static int acf_rand_exec(struct ast_channel *chan, char *cmd,
 
 	AST_STANDARD_APP_ARGS(args, parse);
 
-	if (ast_strlen_zero(args.min) || sscanf(args.min, "%d", &min_int) != 1)
+	if (ast_strlen_zero(args.min) || sscanf(args.min, "%30d", &min_int) != 1)
 		min_int = 0;
 
-	if (ast_strlen_zero(args.max) || sscanf(args.max, "%d", &max_int) != 1)
+	if (ast_strlen_zero(args.max) || sscanf(args.max, "%30d", &max_int) != 1)
 		max_int = RAND_MAX;
 
 	if (max_int < min_int) {
diff --git a/funcs/func_strings.c b/funcs/func_strings.c
index b0e7dfb50..68f806ff1 100644
--- a/funcs/func_strings.c
+++ b/funcs/func_strings.c
@@ -289,7 +289,7 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
 
 				/* Convert the argument into the required type */
 				if (arg.var[argcount]) {
-					if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
+					if (sscanf(arg.var[argcount++], "%30d", &tmpi) != 1) {
 						ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
 						goto sprintf_fail;
 					}
@@ -312,7 +312,7 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu
 
 				/* Convert the argument into the required type */
 				if (arg.var[argcount]) {
-					if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
+					if (sscanf(arg.var[argcount++], "%30lf", &tmpd) != 1) {
 						ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
 						goto sprintf_fail;
 					}