From 5cd8a53ae80685a79938831d82f7caa4c3dbd7de Mon Sep 17 00:00:00 2001 From: Chris Rienzo Date: Mon, 1 Nov 2021 13:50:26 +0000 Subject: [PATCH] [mod_voicemail_ivr] Fix array overflow --- src/mod/applications/mod_voicemail_ivr/menu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/mod/applications/mod_voicemail_ivr/menu.c b/src/mod/applications/mod_voicemail_ivr/menu.c index 79aa16b56e..8a21353c93 100644 --- a/src/mod/applications/mod_voicemail_ivr/menu.c +++ b/src/mod/applications/mod_voicemail_ivr/menu.c @@ -730,13 +730,15 @@ char *vmivr_menu_get_input_set(switch_core_session_t *session, vmivr_profile_t * for (retry = menu->ivr_maximum_attempts; switch_channel_ready(channel) && retry > 0; retry--) { int i; + int dtmfa_array_length = 0; menu_instance_init(menu); switch_event_add_header(menu->phrase_params, SWITCH_STACK_BOTTOM, "IVR-Retry-Left", "%d", retry); /* Find the last entry and append this one to it */ - for (i=0; i < 16 && menu->dtmfa[i]; i++){ + dtmfa_array_length = sizeof(menu->dtmfa) / sizeof(menu->dtmfa[0]); + for (i = 0; i < (dtmfa_array_length - 1) && menu->dtmfa[i]; i++){ } menu->dtmfa[i] = (char *) input_mask;