[asterisk-commits] gtjoseph: branch 11 r423277 - in /branches/11: ./ include/asterisk/ main/

[SVN commits to the Asterisk project]

Author: gtjoseph
Date: Thu Sep 18 09:42:26 2014
New Revision: 423277

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=423277
Log:
config: bug: Fix SEGV in ast_category_insert when matching category isn't found

If you call ast_category_insert with a match category that doesn't exist, the
list traverse runs out of 'next' categories and you get a SEGV.  This patch
adds check for the end-of-list condition and changes the signature to return
an int for success/failure indication instead of a void.

The only consumer of this function is manager and it was also changed to use
the return value.

Tested by: George Joseph
Review: https://reviewboard.asterisk.org/r/3993/
........

Merged revisions 423276 from http://svn.asterisk.org/svn/asterisk/branches/1.8

Modified:
    branches/11/   (props changed)
    branches/11/include/asterisk/config.h
    branches/11/main/config.c
    branches/11/main/manager.c

Propchange: branches/11/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.

Modified: branches/11/include/asterisk/config.h
URL: http://svnview.digium.com/svn/asterisk/branches/11/include/asterisk/config.h?view=diff&rev=423277&r1=423276&r2=423277
==============================================================================
--- branches/11/include/asterisk/config.h (original)
+++ branches/11/include/asterisk/config.h Thu Sep 18 09:42:26 2014
@@ -576,8 +576,11 @@
  * \details
  * This function is used to insert a new category above another category
  * matching the match parameter.
- */
-void ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match);
+ *
+ * \retval 0 if succeeded
+ * \retval -1 if NULL parameters or match category was not found
+ */
+int ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match);
 int ast_category_delete(struct ast_config *cfg, const char *category);
 
 /*!

Modified: branches/11/main/config.c
URL: http://svnview.digium.com/svn/asterisk/branches/11/main/config.c?view=diff&rev=423277&r1=423276&r2=423277
==============================================================================
--- branches/11/main/config.c (original)
+++ branches/11/main/config.c Thu Sep 18 09:42:26 2014
@@ -729,24 +729,28 @@
 	config->current = category;
 }
 
-void ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match)
+int ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match)
 {
 	struct ast_category *cur_category;
 
-	if (!cat || !match)
-		return;
+	if (!config || !cat || !match) {
+		return -1;
+	}
 	if (!strcasecmp(config->root->name, match)) {
 		cat->next = config->root;
 		config->root = cat;
-		return;
-	}
-	for (cur_category = config->root; cur_category; cur_category = cur_category->next) {
+		return 0;
+	}
+	for (cur_category = config->root; cur_category && cur_category->next;
+		cur_category = cur_category->next) {
 		if (!strcasecmp(cur_category->next->name, match)) {
 			cat->next = cur_category->next;
 			cur_category->next = cat;
-			break;
-		}
-	}
+			return 0;
+		}
+	}
+
+	return -1;
 }
 
 static void ast_destroy_template_list(struct ast_category *cat)

Modified: branches/11/main/manager.c
URL: http://svnview.digium.com/svn/asterisk/branches/11/main/manager.c?view=diff&rev=423277&r1=423276&r2=423277
==============================================================================
--- branches/11/main/manager.c (original)
+++ branches/11/main/manager.c Thu Sep 18 09:42:26 2014
@@ -2933,7 +2933,11 @@
 			if (ast_strlen_zero(match)) {
 				ast_category_append(cfg, category);
 			} else {
-				ast_category_insert(cfg, category, match);
+				if (ast_category_insert(cfg, category, match)) {
+					result = FAILURE_NEWCAT;
+					ast_category_destroy(category);
+					break;
+				}
 			}
 		} else if (!strcasecmp(action, "renamecat")) {
 			if (ast_strlen_zero(value)) {