[asterisk-bugs] [JIRA] (ASTERISK-26481) Major issues with FILE and LEN functions

[Walter Doekes (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26481?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=232801#comment-232801 ] 

Walter Doekes commented on ASTERISK-26481:
------------------------------------------

As for the FILE problem, this code is not going to win any code beauty pageant:
{code}
                        if (fread(fbuf, 1, sizeof(fbuf), ff) < sizeof(fbuf) && !feof(ff)) {
                                ast_log(LOG_ERROR, "Short read?!!\n");
                                fclose(ff);
                                return -1;
                        }
                        for (pos = fbuf; pos < fbuf + sizeof(fbuf); pos++) {
                                LINE_COUNTER(pos, format, current_length);

                                if (current_length == length) {
                                        length_offset = i + (pos - fbuf) + 1;
                                        break;
                                }
                        }
                        ast_debug(3, "length_offset=%" PRId64 ", length_offset - i=%" PRId64 "\n", length_offset, length_offset - i);
                        ast_str_append_substr(buf, len, fbuf, (length_offset >= 0) ? length_offset - i : (flength > i + sizeof(fbuf)) ? sizeof(fbuf) : flength - i);

                        if (length_offset >= 0) {
                                break;
                        }
{code}
I suspect that this code assumes that it has found a line, including a newline. But you didn't write a newline into the file, so it probably gets some stack garbage from fbuf instead.

Try {{ASTERISK-26481_workaround_fixes_only_half_the_code.patch}}

> Major issues with FILE and LEN functions
> ----------------------------------------
>
>                 Key: ASTERISK-26481
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26481
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Functions/func_cut
>    Affects Versions: 14.0.1
>         Environment: Linux 4.4.0-38-generic #57-Ubuntu SMP Tue Sep 6 15:42:33 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
>            Reporter: Jonathan Harris
>            Assignee: Rusty Newton
>            Severity: Critical
>              Labels: dialplan, file, len, string, variables
>         Attachments: ASTERISK-26481_workaround_fixes_only_half_the_code.patch
>
>
> Something appears wrong with both the FILE and LEN functions
> This bit of dialplan shows some examples: (edited to replace code with links as this trackers messes up code)
> https://gist.githubusercontent.com/lardconcepts/2b6eb371748c4bb2202082a44e5be871/raw/f67b202223cb2ae3b539259b7e047c60cb0c2543/test-dp
> ...produces this output: (tidied only for posting) - this is messed up in so many ways.
> https://gist.githubusercontent.com/lardconcepts/9a8c0b601bccde18f857eb6fe09b73ed/raw/139579ac70034178f7a0a7e9eeb84d33bba462a9/dp-output
> LEN is showing the wrong length. 
> 1 character gets a weird character added.
> 23, and 4  characters OK
> 5 characters loses a character - BUT LOOK! Even though hexdump prints the correct contents and length, have a close look at this: 35|12345|  whereas normally it would have a space before the pipe.
> 6 characters is OK
>  (by the way, Component with id 'functions/func_len' does not exist)



--
This message was sent by Atlassian JIRA
(v6.2#6252)