From 7d1a06a5dd9c5ce12e6b9a6972c3366e3eb39b50 Mon Sep 17 00:00:00 2001
From: Scott Griepentrog <sgriepentrog@digium.com>
Date: Wed, 21 May 2014 19:05:32 +0000
Subject: [PATCH] pbx.c: prevent potential crash from recursive replace()

Recurisve usage of replace() resulted in corruption of the
temporary string storage and potential crash.  By changing
the string to be allocated separtely per instance, this is
eliminated.

ASTERISK-23650 #comment Reported by: Roel van Meer
ASTEIRSK-23650 #close

Review: https://reviewboard.asterisk.org/r/3539/
........

Merged revisions 414214 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@414215 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 funcs/func_strings.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/funcs/func_strings.c b/funcs/func_strings.c
index 57b7720887..e8ec3fcf83 100644
--- a/funcs/func_strings.c
+++ b/funcs/func_strings.c
@@ -798,7 +798,7 @@ static int replace(struct ast_channel *chan, const char *cmd, char *data, struct
 		AST_APP_ARG(replace);
 	);
 	char *strptr, *varsubst;
-	struct ast_str *str = ast_str_thread_get(&result_buf, 16);
+	RAII_VAR(struct ast_str *, str, ast_str_create(16), ast_free);
 	char find[256]; /* Only 256 characters possible */
 	char replace[2] = "";
 	size_t unused;
-- 
GitLab