[asterisk-bugs] [Asterisk 0014362]: [patch] Putting a comma in an extension dialpattern causes eventual seg fault

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=14362 
====================================================================== 
Reported By:                Nick_Lewis
Assigned To:                Corydon76
====================================================================== 
Project:                    Asterisk
Issue ID:                   14362
Category:                   Core/PBX
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     closed
Asterisk Version:           1.6.1-beta4 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2009-01-29 07:25 CST
Last Modified:              2009-02-03 18:45 CST
====================================================================== 
Summary:                    [patch] Putting a comma in an extension dialpattern
causes eventual seg fault
Description: 
If there is erroneously a comma in an extension dialpattern such as 

_9[1-3,5-9]. 

this leads some time later to a segmentation fault by various *s2=???
assignments in add_exten_to_pattern_tree() of pbx.c

There looks to be a string-unbounded while loop causing it 
====================================================================== 

---------------------------------------------------------------------- 
 (0099385) svnbot (reporter) - 2009-02-03 18:45
 http://bugs.digium.com/view.php?id=14362#c99385 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 173312

_U  branches/1.6.0/
U   branches/1.6.0/main/pbx.c

------------------------------------------------------------------------
r173312 | tilghman | 2009-02-03 18:45:33 -0600 (Tue, 03 Feb 2009) | 17
lines

Merged revisions 173311 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

........
  r173311 | tilghman | 2009-02-03 18:43:52 -0600 (Tue, 03 Feb 2009) | 10
lines
  
  Ensure that commas placed in the middle of extension character classes
do not
  interfere with correct parsing of the extension.  Also, if an
unterminated
  character class DOES make its way into the pbx core (through some other
  method), ensure that it does not crash Asterisk.
  (closes issue http://bugs.digium.com/view.php?id=14362)
   Reported by: Nick_Lewis
   Patches: 
         20090129__bug14362.diff.txt uploaded by Corydon76 (license 14)
   Tested by: Corydon76
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=173312 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-02-03 18:45 svnbot         Checkin                                      
2009-02-03 18:45 svnbot         Note Added: 0099385                          
======================================================================