[asterisk-commits] tilghman: branch 1.6.0 r138025 - in /branches/1.6.0: ./ funcs/func_strings.c

[SVN commits to the Asterisk project]

Author: tilghman
Date: Fri Aug 15 10:04:14 2008
New Revision: 138025

URL: http://svn.digium.com/view/asterisk?view=rev&rev=138025
Log:
Merged revisions 138024 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
r138024 | tilghman | 2008-08-15 10:03:32 -0500 (Fri, 15 Aug 2008) | 16 lines

Merged revisions 138023 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r138023 | tilghman | 2008-08-15 09:51:12 -0500 (Fri, 15 Aug 2008) | 8 lines

Additional check for more string specifiers than arguments.
(closes issue #13299)
 Reported by: adomjan
 Patches: 
       20080813__bug13299.diff.txt uploaded by Corydon76 (license 14)
       func_strings.c-sprintf.patch uploaded by adomjan (license 487)
 Tested by: adomjan

........

................

Modified:
    branches/1.6.0/   (props changed)
    branches/1.6.0/funcs/func_strings.c

Propchange: branches/1.6.0/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.0/funcs/func_strings.c
URL: http://svn.digium.com/view/asterisk/branches/1.6.0/funcs/func_strings.c?view=diff&rev=138025&r1=138024&r2=138025
==============================================================================
--- branches/1.6.0/funcs/func_strings.c (original)
+++ branches/1.6.0/funcs/func_strings.c Fri Aug 15 10:04:14 2008
@@ -496,8 +496,13 @@
 				formatbuf[&arg.format[i] - formatstart + 1] = '\0';
 
 				/* Convert the argument into the required type */
-				if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
-					ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+				if (arg.var[argcount]) {
+					if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
+						ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+						goto sprintf_fail;
+					}
+				} else {
+					ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
 					goto sprintf_fail;
 				}
 
@@ -514,8 +519,13 @@
 				formatbuf[&arg.format[i] - formatstart + 1] = '\0';
 
 				/* Convert the argument into the required type */
-				if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
-					ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+				if (arg.var[argcount]) {
+					if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
+						ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+						goto sprintf_fail;
+					}
+				} else {
+					ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
 					goto sprintf_fail;
 				}
 
@@ -562,6 +572,7 @@
 			}
 		}
 	}
+	*bufptr = '\0';
 	return 0;
 sprintf_fail:
 	return -1;