From 223ce289ccdbc76a182e932f81c0045187dd2480 Mon Sep 17 00:00:00 2001 From: tilghman Date: Fri, 15 Aug 2008 14:51:12 +0000 Subject: Additional check for more string specifiers than arguments. (closes issue #13299) Reported by: adomjan Patches: 20080813__bug13299.diff.txt uploaded by Corydon76 (license 14) func_strings.c-sprintf.patch uploaded by adomjan (license 487) Tested by: adomjan git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@138023 f38db490-d61c-443f-a65b-d21fe96a405b --- funcs/func_strings.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'funcs/func_strings.c') diff --git a/funcs/func_strings.c b/funcs/func_strings.c index 10c274efd..793b016b1 100644 --- a/funcs/func_strings.c +++ b/funcs/func_strings.c @@ -300,8 +300,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu formatbuf[&arg.format[i] - formatstart + 1] = '\0'; /* Convert the argument into the required type */ - if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) { - ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf); + if (arg.var[argcount]) { + if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) { + ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf); + goto sprintf_fail; + } + } else { + ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n"); goto sprintf_fail; } @@ -318,8 +323,13 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu formatbuf[&arg.format[i] - formatstart + 1] = '\0'; /* Convert the argument into the required type */ - if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) { - ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf); + if (arg.var[argcount]) { + if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) { + ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf); + goto sprintf_fail; + } + } else { + ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n"); goto sprintf_fail; } @@ -366,6 +376,7 @@ static int acf_sprintf(struct ast_channel *chan, char *cmd, char *data, char *bu } } } + *bufptr = '\0'; return 0; sprintf_fail: return -1; -- cgit v1.2.3