[asterisk-commits] russell: branch 1.6.2 r269418 - in /branches/1.6.2: ./ include/asterisk/ main/

[SVN commits to the Asterisk project]

Author: russell
Date: Wed Jun  9 16:13:30 2010
New Revision: 269418

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=269418
Log:
Merged revisions 269417 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

........
  r269417 | russell | 2010-06-09 16:11:43 -0500 (Wed, 09 Jun 2010) | 6 lines
  
  Resolve an invalid memory read on an event.
  
  Valgrind pointed out that attempting to get an IE value from an event that has
  no IEs produces an invalid memory read past the end of the event.  Thanks to
  mmichelson for pointing the problem out to me and then testing the fix.
........

Modified:
    branches/1.6.2/   (props changed)
    branches/1.6.2/include/asterisk/event.h
    branches/1.6.2/main/event.c

Propchange: branches/1.6.2/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.2/include/asterisk/event.h
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.2/include/asterisk/event.h?view=diff&rev=269418&r1=269417&r2=269418
==============================================================================
--- branches/1.6.2/include/asterisk/event.h (original)
+++ branches/1.6.2/include/asterisk/event.h Wed Jun  9 16:13:30 2010
@@ -590,9 +590,10 @@
  * \param iterator The iterator instance to initialize
  * \param event The event that will be iterated through
  *
- * \return Nothing
- */
-void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event);
+ * \retval 0 Success, there are IEs available to iterate
+ * \retval -1 Failure, there are no IEs in the event to iterate
+ */
+int ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event);
 
 /*!
  * \brief Move iterator instance to next IE

Modified: branches/1.6.2/main/event.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.2/main/event.c?view=diff&rev=269418&r1=269417&r2=269418
==============================================================================
--- branches/1.6.2/main/event.c (original)
+++ branches/1.6.2/main/event.c Wed Jun  9 16:13:30 2010
@@ -809,12 +809,20 @@
 	return NULL;
 }
 
-void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
-{
+int ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
+{
+	int res = 0;
+
 	iterator->event_len = ntohs(event->event_len);
 	iterator->event = event;
-	iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
-	return;
+	if (iterator->event_len >= sizeof(*event) + sizeof(struct ast_event_ie)) {
+		iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
+	} else {
+		iterator->ie = NULL;
+		res = -1;
+	}
+
+	return res;
 }
 
 int ast_event_iterator_next(struct ast_event_iterator *iterator)
@@ -884,9 +892,10 @@
 	struct ast_event_iterator iterator;
 	int res = 0;
 
-	for (ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
-		if (ast_event_iterator_get_ie_type(&iterator) == ie_type)
+	for (res = ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
+		if (ast_event_iterator_get_ie_type(&iterator) == ie_type) {
 			return ast_event_iterator_get_ie_raw(&iterator);
+		}
 	}
 
 	return NULL;