[asterisk-commits] lmadsen: tag 1.6.1.21 r302146 - in /tags/1.6.1.21: ./ main/

[SVN commits to the Asterisk project]

Author: lmadsen
Date: Mon Jan 17 12:58:13 2011
New Revision: 302146

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=302146
Log:
AST-2011-001

Modified:
    tags/1.6.1.21/.version
    tags/1.6.1.21/ChangeLog
    tags/1.6.1.21/main/utils.c

Modified: tags/1.6.1.21/.version
URL: http://svnview.digium.com/svn/asterisk/tags/1.6.1.21/.version?view=diff&rev=302146&r1=302145&r2=302146
==============================================================================
--- tags/1.6.1.21/.version (original)
+++ tags/1.6.1.21/.version Mon Jan 17 12:58:13 2011
@@ -1,1 +1,1 @@
-1.6.1.20
+1.6.1.21

Modified: tags/1.6.1.21/ChangeLog
URL: http://svnview.digium.com/svn/asterisk/tags/1.6.1.21/ChangeLog?view=diff&rev=302146&r1=302145&r2=302146
==============================================================================
--- tags/1.6.1.21/ChangeLog (original)
+++ tags/1.6.1.21/ChangeLog Mon Jan 17 12:58:13 2011
@@ -1,3 +1,9 @@
+2011-01-17  Leif Madsen <lmadsen at digium.com>
+
+	* Asterisk 1.6.1.21 Released.
+
+	* AST-2011-001: Stack buffer overflow in SIP channel driver
+
 2010-05-17  Leif Madsen <lmadsen at digium.com>
 
 	* Asterisk 1.6.1.20 Released

Modified: tags/1.6.1.21/main/utils.c
URL: http://svnview.digium.com/svn/asterisk/tags/1.6.1.21/main/utils.c?view=diff&rev=302146&r1=302145&r2=302146
==============================================================================
--- tags/1.6.1.21/main/utils.c (original)
+++ tags/1.6.1.21/main/utils.c Mon Jan 17 12:58:13 2011
@@ -385,28 +385,27 @@
 	char *reserved = ";/?:@&=+$,# ";	/* Reserved chars */
 
  	const char *ptr  = string;	/* Start with the string */
-	char *out = NULL;
-	char *buf = NULL;
-
-	ast_copy_string(outbuf, string, buflen);
-
-	/* If there's no characters to convert, just go through and don't do anything */
-	while (*ptr) {
+	char *out = outbuf;
+
+	/* If there's no characters to convert, just go through and copy the string */
+	while (*ptr && out - outbuf < buflen - 1) {
 		if ((*ptr < 32) || (doreserved && strchr(reserved, *ptr))) {
-			/* Oops, we need to start working here */
-			if (!buf) {
-				buf = outbuf;
-				out = buf + (ptr - string) ;	/* Set output ptr */
+			if (out - outbuf >= buflen - 3) {
+				break;
 			}
+
 			out += sprintf(out, "%%%02x", (unsigned char) *ptr);
-		} else if (buf) {
-			*out = *ptr;	/* Continue copying the string */
+		} else {
+			*out = *ptr;	/* copy the character */
 			out++;
-		} 
+		}
 		ptr++;
 	}
-	if (buf)
+
+	if (buflen) {
 		*out = '\0';
+	}
+
 	return outbuf;
 }