pbx.c: Fix crash from malformed exten pattern.
Forgetting to indicate an exten is a pattern can cause a crash if the "pattern" has a character set range. e.g., "9999[3-5]" The crash is due to a buffer overwrite because the '-' exten eye-candy wasn't removed as expected and overran the allocated space. The buffer overwrite is fixed two ways in this patch. 1) Fix ext_strncpy() to distinguish between pattern and non-pattern extens. Now '-' characters are removed when they are eye-candy and not when they are part of a pattern character set. Since the function is private to pbx.c, the return value now returns the number of bytes written to the destination buffer instead of the strlen() of the final buffer so the callers that care don't need to add one. 2) Fix callers to ext_strncpy() to supply the correct available buffer size of the destination buffer. ASTERISK-26668 Change-Id: I555d97411140e47e0522684062d174fbe32aa84a
Loading
Please register or sign in to comment