From b5796a47af381b95374463ec32bd67b73a99c359 Mon Sep 17 00:00:00 2001 From: mmichelson Date: Tue, 10 Feb 2009 23:21:03 +0000 Subject: Merged revisions 174805 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ........ r174805 | mmichelson | 2009-02-10 17:17:03 -0600 (Tue, 10 Feb 2009) | 11 lines Fix potential for stack overflows in app_chanspy.c When using the 'g' or 'e' options, the stack allocations that were used could cause a stack overflow if a spyer stayed on the line long enough without actually successfully spying on anyone. The problem has been corrected by using static buffers and copying the contents of the appropriate strings into them instead of using functions like alloca or ast_strdupa ........ git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.1@174823 f38db490-d61c-443f-a65b-d21fe96a405b --- apps/app_chanspy.c | 55 ++++++++++++++++++++++-------------------------------- 1 file changed, 22 insertions(+), 33 deletions(-) (limited to 'apps') diff --git a/apps/app_chanspy.c b/apps/app_chanspy.c index 7e79eacf0..310e14ab5 100644 --- a/apps/app_chanspy.c +++ b/apps/app_chanspy.c @@ -713,22 +713,9 @@ static int common_exec(struct ast_channel *chan, struct ast_flags *flags, chanspy_ds_free(peer_chanspy_ds), prev = peer, peer_chanspy_ds = next_chanspy_ds ? next_chanspy_ds : next_channel(chan, prev, spec, exten, context, &chanspy_ds), next_chanspy_ds = NULL) { - const char *group; int igrp = !mygroup; - char *groups[NUM_SPYGROUPS]; - char *mygroups[NUM_SPYGROUPS]; - int num_groups = 0; - char dup_group[512]; - int num_mygroups = 0; - char *dup_mygroup; - int x; - int y; - char *s; - char *buffer; - char *end; - char *ext; - char *form_enforced; int ienf = !myenforced; + char *s; peer = peer_chanspy_ds->chan; @@ -757,7 +744,16 @@ static int common_exec(struct ast_channel *chan, struct ast_flags *flags, } if (mygroup) { - dup_mygroup = ast_strdupa(mygroup); + int num_groups = 0; + int num_mygroups = 0; + char dup_group[512]; + char dup_mygroup[512]; + char *groups[NUM_SPYGROUPS]; + char *mygroups[NUM_SPYGROUPS]; + const char *group; + int x; + int y; + ast_copy_string(dup_mygroup, mygroup, sizeof(dup_mygroup)); num_mygroups = ast_app_separate_args(dup_mygroup, ':', mygroups, ARRAY_LEN(mygroups)); @@ -783,35 +779,28 @@ static int common_exec(struct ast_channel *chan, struct ast_flags *flags, } if (myenforced) { + char ext[AST_CHANNEL_NAME + 3]; + char buffer[512]; + char *end; - /* We don't need to allocate more space than just the - length of (peer->name) for ext as we will cut the - channel name's ending before copying into ext */ - - ext = alloca(strlen(peer->name)); - - form_enforced = alloca(strlen(myenforced) + 3); + snprintf(buffer, sizeof(buffer) - 1, ":%s:", myenforced); - strcpy(form_enforced, ":"); - strcat(form_enforced, myenforced); - strcat(form_enforced, ":"); - - buffer = ast_strdupa(peer->name); - - if ((end = strchr(buffer, '-'))) { + ast_copy_string(ext + 1, peer->name, sizeof(ext) - 1); + if ((end = strchr(ext, '-'))) { *end++ = ':'; *end = '\0'; } - strcpy(ext, ":"); - strcat(ext, buffer); + ext[0] = ':'; - if (strcasestr(form_enforced, ext)) + if (strcasestr(buffer, ext)) { ienf = 1; + } } - if (!ienf) + if (!ienf) { continue; + } strcpy(peer_name, "spy-"); strncat(peer_name, peer->name, AST_NAME_STRLEN - 4 - 1); -- cgit v1.2.3