[asterisk-bugs] [Asterisk 0018759]: [patch] Null values in format strings lead to segfault

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=18759 
====================================================================== 
Reported By:                bklang
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   18759
Category:                   Core/Portability
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     confirmed
Asterisk Version:           SVN 
JIRA:                       SWP-3039 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.8 
SVN Revision (number only!): 306529 
Request Review:              
====================================================================== 
Date Submitted:             2011-02-07 07:32 CST
Last Modified:              2011-02-07 12:41 CST
====================================================================== 
Summary:                    [patch] Null values in format strings lead to
segfault
Description: 
This is an issue I have reported in several other places and which have
been fixed.  Instead of opening a single ticket for these three I am
putting them into a single ticket.

res/res_jabber.c:2493 found->description
channels/chan_sip.c:23429 authpeer->name
res/res_fax.c:1770

The first two I have patched trivially and attached it here.  For
res_fax.c I'm not sure which variable was null and whether protection
should be applied to multiple variables so I do not have a patch for this.
====================================================================== 

---------------------------------------------------------------------- 
 (0131585) lathama (developer) - 2011-02-07 12:41
 https://issues.asterisk.org/view.php?id=18759#c131585 
---------------------------------------------------------------------- 
I think I am hitting something close to this...  I will test the patch
tonight...


Core was generated by `/usr/sbin/asterisk -g'.
Program terminated with signal 11, Segmentation fault.
https://issues.asterisk.org/view.php?id=0  0x0000000000489585 in ast_strlen_zero
(cmd=0x97642f0 "sip",
cli_word=0x1e <Address 0x1e out of bounds>) at
/usr/src/1.8.3/include/asterisk/strings.h:65
65              return (!s || (*s == '\0'));
https://issues.asterisk.org/view.php?id=0  0x0000000000489585 in ast_strlen_zero
(cmd=0x97642f0 "sip",
cli_word=0x1e <Address 0x1e out of bounds>) at
/usr/src/1.8.3/include/asterisk/strings.h:65
No locals.
https://issues.asterisk.org/view.php?id=1  word_match (cmd=0x97642f0 "sip",
cli_word=0x1e <Address 0x1e out of
bounds>) at cli.c:1874 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-02-07 12:41 lathama        Note Added: 0131585                          
======================================================================