[asterisk-commits] sgriepentrog: branch 1.8 r414214 - /branches/1.8/funcs/func_strings.c

[SVN commits to the Asterisk project]

Author: sgriepentrog
Date: Wed May 21 13:58:47 2014
New Revision: 414214

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=414214
Log:
pbx.c: prevent potential crash from recursive replace()

Recurisve usage of replace() resulted in corruption of the
temporary string storage and potential crash.  By changing
the string to be allocated separtely per instance, this is
eliminated.

ASTERISK-23650 #comment Reported by: Roel van Meer
ASTEIRSK-23650 #close

Review: https://reviewboard.asterisk.org/r/3539/


Modified:
    branches/1.8/funcs/func_strings.c

Modified: branches/1.8/funcs/func_strings.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.8/funcs/func_strings.c?view=diff&rev=414214&r1=414213&r2=414214
==============================================================================
--- branches/1.8/funcs/func_strings.c (original)
+++ branches/1.8/funcs/func_strings.c Wed May 21 13:58:47 2014
@@ -780,7 +780,7 @@
 		AST_APP_ARG(replace);
 	);
 	char *strptr, *varsubst;
-	struct ast_str *str = ast_str_thread_get(&result_buf, 16);
+	RAII_VAR(struct ast_str *, str, ast_str_create(16), ast_free);
 	char find[256]; /* Only 256 characters possible */
 	char replace[2] = "";
 	size_t unused;