[asterisk-bugs] [Asterisk 0017893]: 'dialplan save' crash when '|' (pipe) is used. Patch included.

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17893 
====================================================================== 
Reported By:                knutant
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17893
Category:                   PBX/pbx_config
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.35 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-08-20 07:39 CDT
Last Modified:              2010-08-20 15:37 CDT
====================================================================== 
Summary:                    'dialplan save' crash when '|' (pipe) is used. Patch
included.
Description: 
I was trying out the 'dialplan save' call from the asterisk CLI and it
crashed when trying to write out this line (which it had already read from
extensions.conf on startup):

exten => 1234,1,RTPPage(basic|224.0.0.1:7000|ulaw|ef)

By looking at the code I noticed that it tries to replace '|' with ',' but
the buffer it writes to is only allocated to 1 byte, so it crashes. It
might be worth noting that I ran Asterisk on a blackfin processor under
uClinux, but looking at the code I do not thing that matters.

The problem is located at line 1370 in pbx/pbx_config.c where the char
pointer to tempdata is allocated. It takes strlen(tempdata) instead of
strlen(s) and because tempdata is set to an empty string a few lines up,
this will always allocate a single byte.

I've looked at the latest revision of pbx_config.c in the 1.4 branch, and
the problem is still there. I've added a patch in the addition information
field. By using this patch, the crash is avoided and the writeout seems to
work correctly.

====================================================================== 

---------------------------------------------------------------------- 
 (0126203) pabelanger (manager) - 2010-08-20 15:37
 https://issues.asterisk.org/view.php?id=17893#c126203 
---------------------------------------------------------------------- 
While only a one line fix, please upload your patch to the tracker using
'svn diff'.  It makes it easier for people to download and test. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-08-20 15:37 pabelanger     Note Added: 0126203                          
======================================================================