summaryrefslogtreecommitdiff
path: root/net-misc/asterisk/files/asterisk-historic-dundi-null-dereference.patch
blob: 8fb5319379898146d4d4a79b2c563598eb0464bc (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Upstream issue 21205
Link: https://issues.asterisk.org/jira/browse/ASTERISK-21205

Submitted upstream:   2013-03-05 07:06
For Asterisk version: 11.2.1
Patch by: Jaco Kroon

If a negative (error) return is received from dundi_lookup_internal, this is not handled 
correctly when assigning the result to the buffer. As such, use a signed integer in the 
assignment and do a proper comparison.

--- a/pbx/pbx_dundi.c	2013-03-05 15:07:00.523387892 +0200
+++ b/pbx/pbx_dundi.c	2013-03-05 15:18:49.512625981 +0200
@@ -4123,7 +4123,7 @@
 
 struct dundi_result_datastore {
 	struct dundi_result results[MAX_RESULTS];
-	unsigned int num_results;
+	int num_results;
 	unsigned int id;
 };
 
@@ -4255,7 +4255,7 @@
 	drds = datastore->data;
 
 	if (!strcasecmp(args.resultnum, "getnum")) {
-		snprintf(buf, len, "%u", drds->num_results);
+		snprintf(buf, len, "%u", drds->num_results < 0 ? 0 : drds->num_results);
 		res = 0;
 		goto finish;
 	}
@@ -4266,7 +4266,7 @@
 		goto finish;
 	}
 
-	if (num && num <= drds->num_results) {
+	if (num && drds->num_results > 0 && num <= drds->num_results) {
 		snprintf(buf, len, "%s/%s", drds->results[num - 1].tech, drds->results[num - 1].dest);
 		res = 0;
 	} else