core_unreal: Fix off by one buffer overwrite error.
authorRichard Mudgett <rmudgett@digium.com>
Mon, 23 Jun 2014 16:04:33 +0000 (16:04 +0000)
committerRichard Mudgett <rmudgett@digium.com>
Mon, 23 Jun 2014 16:04:33 +0000 (16:04 +0000)
Appending the ;2 to the user supplied ;1 uniqueid to create the ;2 version
if the user did not also supply an extra uniqueid for the ;2 channel
resulted in allocating a buffer that was one byte too small.

* Fix off by one error in ast_unreal_new_channels() when generating the ;2
uniqueid from the user suppled ;1 version.

* Pulled some long assignment lines from if tests to improve line break
readability in ast_unreal_new_channels().
........

Merged revisions 417119 from http://svn.asterisk.org/svn/asterisk/branches/12

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@417120 65c4cc65-6c06-0410-ace0-fbb531ad65f3

main/core_unreal.c

index 481ed2d..c9afa51 100644 (file)
@@ -911,7 +911,7 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
        if (id1.uniqueid && ast_strlen_zero(id2.uniqueid)) {
                char *uniqueid2;
 
-               uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 2);
+               uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 3);
                strcpy(uniqueid2, id1.uniqueid);/* Safe */
                strcat(uniqueid2, ";2");/* Safe */
                id2.uniqueid = uniqueid2;
@@ -924,9 +924,10 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
         * You can't pass linkedid to both allocations since if linkedid
         * isn't set, then each channel will generate its own linkedid.
         */
-       if (!(owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
-                       exten, context, &id1, requestor, 0,
-                       "%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno))) {
+       owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
+               exten, context, &id1, requestor, 0,
+               "%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno);
+       if (!owner) {
                ast_log(LOG_WARNING, "Unable to allocate owner channel structure\n");
                return NULL;
        }
@@ -964,9 +965,10 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
        p->owner = owner;
        ast_channel_unlock(owner);
 
-       if (!(chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
-                       exten, context, &id2, owner, 0,
-                       "%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno))) {
+       chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
+               exten, context, &id2, owner, 0,
+               "%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno);
+       if (!chan) {
                ast_log(LOG_WARNING, "Unable to allocate chan channel structure\n");
                ao2_ref(p, -1);
                ast_channel_tech_pvt_set(owner, NULL);