[asterisk-bugs] [Asterisk 0017893]: [patch] 'dialplan save' crash when '|' (pipe) is used. Patch included.

[Asterisk Bug Tracker]

The following issue has been CLOSED 
====================================================================== 
https://issues.asterisk.org/view.php?id=17893 
====================================================================== 
Reported By:                knutant
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17893
Category:                   PBX/pbx_config
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     closed
Asterisk Version:           1.4.35 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 open
Fixed in Version:           
====================================================================== 
Date Submitted:             2010-08-20 07:39 CDT
Last Modified:              2010-10-14 13:55 CDT
====================================================================== 
Summary:                    [patch] 'dialplan save' crash when '|' (pipe) is
used. Patch included.
Description: 
I was trying out the 'dialplan save' call from the asterisk CLI and it
crashed when trying to write out this line (which it had already read from
extensions.conf on startup):

exten => 1234,1,RTPPage(basic|224.0.0.1:7000|ulaw|ef)

By looking at the code I noticed that it tries to replace '|' with ',' but
the buffer it writes to is only allocated to 1 byte, so it crashes. It
might be worth noting that I ran Asterisk on a blackfin processor under
uClinux, but looking at the code I do not thing that matters.

The problem is located at line 1370 in pbx/pbx_config.c where the char
pointer to tempdata is allocated. It takes strlen(tempdata) instead of
strlen(s) and because tempdata is set to an empty string a few lines up,
this will always allocate a single byte.

I've looked at the latest revision of pbx_config.c in the 1.4 branch, and
the problem is still there. I've added a patch in the addition information
field. By using this patch, the crash is avoided and the writeout seems to
work correctly.

====================================================================== 

---------------------------------------------------------------------- 
 (0128052) lmadsen (administrator) - 2010-10-14 13:55
 https://issues.asterisk.org/view.php?id=17893#c128052 
---------------------------------------------------------------------- 
No feedback from reporter. Suspending issue. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-10-14 13:55 lmadsen        Note Added: 0128052                          
2010-10-14 13:55 lmadsen        Status                   needs license => closed
======================================================================