Preston_PLB/freeswitch
1
0
Fork 0
forked from Mirrors/freeswitch
Code Pull Requests Activity

FS-10001: [core] Fix Buffer overflow collecting digits

Browse Source
This commit is contained in:
Mike Jerris 2017-03-06 12:51:29 -06:00
parent d5e558fa44
commit 25bbb42ec2
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mod/applications/mod_dptools/mod_dptools.c
View File

@ -935,6 +935,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_failed"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 5000, 0, 0);
continue;
}
@ -954,6 +955,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_failed"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 5000, 0, 0);
}
}
@ -962,6 +964,7 @@ SWITCH_STANDARD_APP(eavesdrop_function)
if ((file = switch_channel_get_variable(channel, "eavesdrop_indicate_idle"))) {
switch_ivr_play_file(session, NULL, file, NULL);
}
buf[0] = '\0';
switch_ivr_collect_digits_count(session, buf, buflen, 1, "*", &terminator, 2000, 0, 0);
}
}

5
src/switch_ivr.c
View File

@ -1333,6 +1333,11 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_collect_digits_count(switch_core_sess
int sval = 0;
const char *var;
if (x >= buflen || x >= maxdigits) {
return SWITCH_STATUS_FALSE;
}
if ((var = switch_channel_get_variable(channel, SWITCH_SEND_SILENCE_WHEN_IDLE_VARIABLE)) && (sval = atoi(var))) {
switch_core_session_get_read_impl(session, &imp);