[asterisk-bugs] [Asterisk 0014362]: [patch] Putting a comma in an extension dialpattern causes eventual seg fault

[Asterisk Bug Tracker]

The following issue is now READY FOR TESTING. 
====================================================================== 
http://bugs.digium.com/view.php?id=14362 
====================================================================== 
Reported By:                Nick_Lewis
Assigned To:                Corydon76
====================================================================== 
Project:                    Asterisk
Issue ID:                   14362
Category:                   Core/PBX
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     ready for testing
Asterisk Version:           1.6.1-beta4 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-01-29 07:25 CST
Last Modified:              2009-01-29 13:16 CST
====================================================================== 
Summary:                    [patch] Putting a comma in an extension dialpattern
causes eventual seg fault
Description: 
If there is erroneously a comma in an extension dialpattern such as 

_9[1-3,5-9]. 

this leads some time later to a segmentation fault by various *s2=???
assignments in add_exten_to_pattern_tree() of pbx.c

There looks to be a string-unbounded while loop causing it 
====================================================================== 

---------------------------------------------------------------------- 
 (0099075) Corydon76 (administrator) - 2009-01-29 13:16
 http://bugs.digium.com/view.php?id=14362#c99075 
---------------------------------------------------------------------- 
There are two things I'm doing.  The first is to incorporate your patch,
because it clearly is needed.  For example, if someone typoed their config,
then it should error out correctly.

Secondarily, I'm creating a patch which allows you to legitimately code a
comma into an extension, as long as it exists within square brackets, as
you have done here (unnecessarily, in your case), in case somebody wants to
actually match a comma character in an extension.

Patch has been uploaded and initially tested.  Let's see if you can find a
case to crash it. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-01-29 13:16 Corydon76      Note Added: 0099075                          
2009-01-29 13:16 Corydon76      Status                   assigned => ready for
testing
======================================================================