diff options
-rw-r--r-- | main/pbx.c | 3 | ||||
-rw-r--r-- | pbx/pbx_config.c | 32 |
2 files changed, 34 insertions, 1 deletions
diff --git a/main/pbx.c b/main/pbx.c index c6c29a2e8..39a3d8ba2 100644 --- a/main/pbx.c +++ b/main/pbx.c @@ -1900,6 +1900,9 @@ static struct match_char *add_exten_to_pattern_tree(struct ast_context *con, str *s2++ = s3; } s1++; s1++; + } else if (*s1 == '\0') { + ast_log(LOG_WARNING, "A matching ']' was not found for '[' in pattern string '%s'\n", extenbuf); + break; } else { *s2++ = *s1++; } diff --git a/pbx/pbx_config.c b/pbx/pbx_config.c index 64c99b500..6d29a3f32 100644 --- a/pbx/pbx_config.c +++ b/pbx/pbx_config.c @@ -1403,6 +1403,36 @@ static int unload_module(void) return 0; } +/*!\note Protect against misparsing based upon commas in the middle of fields + * like character classes. We've taken steps to permit pretty much every other + * printable character in a character class, so properly handling a comma at + * this level is a natural extension. This is almost like the standard + * application parser in app.c, except that it handles square brackets. */ +static char *pbx_strsep(char **destructible, const char *delim) +{ + int square = 0; + char *res = *destructible; + for (; destructible && *destructible && **destructible; (*destructible)++) { + if (**destructible == '[' && !strchr(delim, '[')) { + square++; + } else if (**destructible == ']' && !strchr(delim, ']')) { + if (square) { + square--; + } + } else if (**destructible == '\\' && !strchr(delim, '\\')) { + (*destructible)++; + } else if (strchr(delim, **destructible) && !square) { + **destructible = '\0'; + (*destructible)++; + break; + } + } + if (destructible && *destructible && **destructible == '\0') { + *destructible = NULL; + } + return res; +} + static int pbx_load_config(const char *config_file) { struct ast_config *cfg; @@ -1488,7 +1518,7 @@ static int pbx_load_config(const char *config_file) continue; } - ext = S_OR(strsep(&stringp, ","), ""); + ext = S_OR(pbx_strsep(&stringp, ","), ""); pbx_substitute_variables_helper(NULL, ext, realext, sizeof(realext) - 1); ast_copy_string(lastextension, realext, sizeof(lastextension)); process_extension: |