retronetworking
/
freeswitch
13
0
Fork 0
Code Pull Requests Releases Activity

FS-10001: [core] Fix Buffer overflow collecting digits

This commit is contained in:
Mike Jerris 2017-03-06 12:51:29 -06:00
parent 3834871e47
commit 2477b9e3d7
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mod/applications/mod_dptools/mod_dptools.c
View File

@ -904,6 +904,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_failed"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 5000, 0, 0);
continue;
}
@ -923,6 +924,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_failed"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 5000, 0, 0);
}
}
@ -931,6 +933,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_idle"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 2000, 0, 0);
}
}

5
src/switch_ivr.c
View File

@ -1304,6 +1304,11 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_collect_digits_count(switch_core_sess
int sval = 0;
const char *var;
if (x >= buflen || x >= maxdigits) {
return SWITCH_STATUS_FALSE;
}
if ((var = switch_channel_get_variable(channel, SWITCH_SEND_SILENCE_WHEN_IDLE_VARIABLE)) && (sval = atoi(var))) {
switch_core_session_get_read_impl(session, &imp);