[asterisk-commits] branch 1.0 - r7558 /branches/1.0/res/res_agi.c

[asterisk-commits at lists.digium.com]

Author: russell
Date: Tue Dec 20 14:23:20 2005
New Revision: 7558

URL: http://svn.digium.com/view/asterisk?rev=7558&view=rev
Log:
check array bounds when parsing arguments to AGI (issue #5868)

Modified:
    branches/1.0/res/res_agi.c

Modified: branches/1.0/res/res_agi.c
URL: http://svn.digium.com/view/asterisk/branches/1.0/res/res_agi.c?rev=7558&r1=7557&r2=7558&view=diff
==============================================================================
--- branches/1.0/res/res_agi.c (original)
+++ branches/1.0/res/res_agi.c Tue Dec 20 14:23:20 2005
@@ -1649,9 +1649,8 @@
 	strncpy(buf, data, sizeof(buf) - 1);
 
 	memset(&agi, 0, sizeof(agi));
-        while ((stringp = strsep(&tmp, "|"))) {
+        while ((stringp = strsep(&tmp, "|")) && argc < MAX_ARGS - 1)
 		argv[argc++] = stringp;
-        }
 	argv[argc] = NULL;
 
 	LOCAL_USER_ADD(u);