[asterisk-bugs] [Asterisk 0017893]: [patch] 'dialplan save' crash when '|' (pipe) is used. Patch included.

[Asterisk Bug Tracker]

The following issue NEEDS LICENSE. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17893 
====================================================================== 
Reported By:                knutant
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17893
Category:                   PBX/pbx_config
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     needs license
Asterisk Version:           1.4.35 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-08-20 07:39 CDT
Last Modified:              2010-08-23 12:37 CDT
====================================================================== 
Summary:                    [patch] 'dialplan save' crash when '|' (pipe) is
used. Patch included.
Description: 
I was trying out the 'dialplan save' call from the asterisk CLI and it
crashed when trying to write out this line (which it had already read from
extensions.conf on startup):

exten => 1234,1,RTPPage(basic|224.0.0.1:7000|ulaw|ef)

By looking at the code I noticed that it tries to replace '|' with ',' but
the buffer it writes to is only allocated to 1 byte, so it crashes. It
might be worth noting that I ran Asterisk on a blackfin processor under
uClinux, but looking at the code I do not thing that matters.

The problem is located at line 1370 in pbx/pbx_config.c where the char
pointer to tempdata is allocated. It takes strlen(tempdata) instead of
strlen(s) and because tempdata is set to an empty string a few lines up,
this will always allocate a single byte.

I've looked at the latest revision of pbx_config.c in the 1.4 branch, and
the problem is still there. I've added a patch in the addition information
field. By using this patch, the crash is avoided and the writeout seems to
work correctly.

====================================================================== 

---------------------------------------------------------------------- 
 (0126233) lmadsen (administrator) - 2010-08-23 12:37
 https://issues.asterisk.org/view.php?id=17893#c126233 
---------------------------------------------------------------------- 
Your license was rejected. Please correct the issue with the license and
resubmit your patch as the one submitted is no longer available for use. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-08-23 12:37 lmadsen        Note Added: 0126233                          
2010-08-23 12:37 lmadsen        Status                   new => needs license
======================================================================