code analysis, bounds checks, buffer overrun fixes.

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@7403 d0543943-73ff-0310-b7d9-9358b9ac24b2

src/include/switch_apr.h

@@ -125,11 +125,11 @@ SWITCH_DECLARE(const char *) switch_dso_error(switch_dso_handle_t * dso, char *b
  * @{
  */
 
-SWITCH_DECLARE(int) switch_snprintf(char *buf, switch_size_t len, const char *format, ...);
+SWITCH_DECLARE(int) switch_snprintf(_Out_z_cap_(len) char *buf, _In_ switch_size_t len, _In_z_ _Printf_format_string_ const char *format, ...);
 
-SWITCH_DECLARE(int) switch_vasprintf(char **buf, const char *format, va_list ap);
+SWITCH_DECLARE(int) switch_vasprintf(_Out_opt_ char **buf, _In_z_ _Printf_format_string_ const char *format, _In_ va_list ap);
 
-SWITCH_DECLARE(char *) switch_copy_string(char *dst, const char *src, switch_size_t dst_size);
+SWITCH_DECLARE(char *) switch_copy_string(_Out_z_cap_(dst_size) char *dst, _In_z_ const char *src, _In_ switch_size_t dst_size);
 
 /** @} */
 

src/include/switch_buffer.h

@@ -58,7 +58,7 @@ SWITCH_BEGIN_EXTERN_C
  * \param max_len length required by the buffer
  * \return status
  */
-SWITCH_DECLARE(switch_status_t) switch_buffer_create(switch_memory_pool_t *pool, switch_buffer_t **buffer, switch_size_t max_len);
+SWITCH_DECLARE(switch_status_t) switch_buffer_create(_In_ switch_memory_pool_t *pool, _Out_ switch_buffer_t **buffer, _In_ switch_size_t max_len);
 
 /*! \brief Allocate a new dynamic switch_buffer 
  * \param buffer returned pointer to the new buffer
@@ -67,8 +67,8 @@ SWITCH_DECLARE(switch_status_t) switch_buffer_create(switch_memory_pool_t *pool,
  * \param max_len length the buffer is allowed to grow to
  * \return status
  */
-SWITCH_DECLARE(switch_status_t) switch_buffer_create_dynamic(switch_buffer_t **buffer, switch_size_t blocksize, switch_size_t start_len,
-															 switch_size_t max_len);
+SWITCH_DECLARE(switch_status_t) switch_buffer_create_dynamic(_Out_ switch_buffer_t **buffer, _In_ switch_size_t blocksize, _In_ switch_size_t start_len,
+															 _In_ switch_size_t max_len);
 
 SWITCH_DECLARE(void) switch_buffer_add_mutex(_In_ switch_buffer_t *buffer, _In_ switch_mutex_t *mutex);
 SWITCH_DECLARE(void) switch_buffer_lock(_In_ switch_buffer_t *buffer);

src/include/switch_core.h

@@ -867,14 +867,14 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_recv_dtmf(_In_ switch_core_s
   \param pool the pool to use for the new hash
   \return SWITCH_STATUS_SUCCESS if the hash is created
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_init(switch_hash_t ** hash, switch_memory_pool_t *pool);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_init(_Out_ switch_hash_t ** hash, _In_ switch_memory_pool_t *pool);
 
 /*! 
   \brief Destroy an existing hash table
   \param hash the hash to destroy
   \return SWITCH_STATUS_SUCCESS if the hash is destroyed
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(switch_hash_t **hash);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(_Inout_ switch_hash_t **hash);
 
 /*! 
   \brief Insert data into a hash
@@ -884,7 +884,7 @@ SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(switch_hash_t **hash);
   \return SWITCH_STATUS_SUCCESS if the data is added
   \note the string key must be a constant or a dynamic string
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_insert(switch_hash_t * hash, const char *key, const void *data);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_insert(_In_ switch_hash_t * hash, _In_z_ const char *key, _In_opt_ const void *data);
 
 /*! 
   \brief Insert data into a hash

src/include/switch_platform.h

@@ -314,7 +314,11 @@ SWITCH_END_EXTERN_C
 #define _Inout_opt_
 #define _In_bytecount_(x)
 #define _Out_opt_bytecapcount_(x)
+#define _Out_bytecapcount_(x)
 #define _Ret_
+#define _Post_z_
+#define _Out_cap_(x)
+#define _Out_z_cap_(x)
 #endif
 
 

src/include/switch_utils.h

@@ -92,7 +92,7 @@ atoi(expr))) ? SWITCH_TRUE : SWITCH_FALSE
   \param family the address family to return (AF_INET or AF_INET6)
   \return SWITCH_STATUS_SUCCESSS for success, otherwise failure
 */
-SWITCH_DECLARE(switch_status_t) switch_find_local_ip(char *buf, int len, int family);
+SWITCH_DECLARE(switch_status_t) switch_find_local_ip(_Out_opt_bytecapcount_(len) char *buf, _In_ int len, _In_ int family);
 
 /*!
   \brief find the char representation of an ip adress

src/mod/applications/mod_voicemail/mod_voicemail.c

@@ -437,7 +437,7 @@ static switch_status_t load_config(void)
 				callback_dialplan = val;
 			} else if (!strcasecmp(var, "callback-context") && !switch_strlen_zero(val)) {
 				callback_context = val;
-			} else if (!strcasecmp(var, "file-extension")) {
+			} else if (!strcasecmp(var, "file-extension") && !switch_strlen_zero(val)) {
 				file_ext = val;
 			} else if (!strcasecmp(var, "record-title") && !switch_strlen_zero(val)) {
 				record_title = val;

src/mod/endpoints/mod_portaudio/mod_portaudio.c

@@ -331,7 +331,7 @@ static void add_pvt(private_t * tech_pvt, int master)
 
 	switch_mutex_lock(globals.pvt_lock);
 
-	if (switch_strlen_zero(tech_pvt->call_id)) {
+	if (*tech_pvt->call_id == '\0') {
 		switch_snprintf(tech_pvt->call_id, sizeof(tech_pvt->call_id), "%d", ++globals.call_id);
 		switch_core_hash_insert(globals.call_hash, tech_pvt->call_id, tech_pvt);
 		switch_core_session_set_read_codec(tech_pvt->session, &globals.read_codec);

src/mod/endpoints/mod_woomera/mod_woomera.c

@@ -98,8 +98,8 @@ struct woomera_message {
 	int mval;
 	char command[WOOMERA_STRLEN];
 	char command_args[WOOMERA_STRLEN];
-	char names[WOOMERA_STRLEN][WOOMERA_ARRAY_LEN];
-	char values[WOOMERA_STRLEN][WOOMERA_ARRAY_LEN];
+	char names[WOOMERA_ARRAY_LEN][WOOMERA_STRLEN];
+	char values[WOOMERA_ARRAY_LEN][WOOMERA_STRLEN];
 	char body[WOOMERA_BODYLEN];
 	unsigned int flags;
 	int last;

src/switch_core.c

@@ -589,7 +589,9 @@ SWITCH_DECLARE(switch_status_t) switch_core_mime_add_type(const char *type, cons
 		if ((argc = switch_separate_string(ext_list, ' ', argv, (sizeof(argv) / sizeof(argv[0]))))) {
 
 			for (x = 0; x < argc; x++) {
-				switch_core_hash_insert(runtime.mime_types, argv[x], ptype);
+				if (argv[x] && ptype) {
+					switch_core_hash_insert(runtime.mime_types, argv[x], ptype);
+				}
 			}
 			
 			status = SWITCH_STATUS_SUCCESS;

src/switch_ivr.c

@@ -999,7 +999,7 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_digit_stream_parser_new(switch_memory
 			*parser = (switch_ivr_digit_stream_parser_t *) switch_core_alloc(pool, sizeof(switch_ivr_digit_stream_parser_t));
 		}
 		// if we have parser object, initialize it for the caller
-		if (*parser != NULL) {
+		if (pool && *parser != NULL) {
 			memset(*parser, 0, sizeof(switch_ivr_digit_stream_parser_t));
 			(*parser)->pool_auto_created = pool_auto_created;
 			(*parser)->pool = pool;

src/switch_utils.c

@@ -549,6 +549,10 @@ SWITCH_DECLARE(switch_status_t) switch_find_local_ip(char *buf, int len, int fam
 	char abuf[25] = "";
 #endif
 
+	if (len < 16) {
+		return status;
+	}
+
 	switch_copy_string(buf, "127.0.0.1", len);
 
 	switch (family) {