[asterisk-dev] [Code Review] 4126: app_voicemail: Fix unchecked bounds of myArray in IMAP_STORAGE.

[wdoekes]

> On Oct. 29, 2014, 2:41 p.m., Matt Jordan wrote:
> > /branches/1.8/apps/app_voicemail.c, lines 3233-3243
> > <https://reviewboard.asterisk.org/r/4126/diff/1/?file=68594#file68594line3233>
> >
> >     The struct vm_state in vm_execmain is allocated on the stack. init_vm_state is called on it if IMAP_STORAGE is defined, regardless of the value of vmu. However, we only call vmstate_delete if vmu was allocated - so this may introduce a potential memory leak (on top of the ones you've already pointed out).
> >     
> >

As far as I can tell, we won't get there unless vmu is non-zero:

        /* Let's hope that this means that if (valid) then (vmu) */
        if (!valid) {
                goto out;
        }

Otherwise we would crash here anyway:

        /* Set language from config to override channel language */
        if (!ast_strlen_zero(vmu->language))
                ast_string_field_set(chan, language, vmu->language);

And we would (have) leak(ed) the mutex too.


Looks like it, based on this too:

        if (valid) {
                int new = 0, old = 0, urgent = 0;
                snprintf(ext_context, sizeof(ext_context), "%s@%s", vms.username, vmu->context);


- wdoekes


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviewboard.asterisk.org/r/4126/#review13614
-----------------------------------------------------------


On Oct. 29, 2014, 9:53 a.m., wdoekes wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviewboard.asterisk.org/r/4126/
> -----------------------------------------------------------
> 
> (Updated Oct. 29, 2014, 9:53 a.m.)
> 
> 
> Review request for Asterisk Developers.
> 
> 
> Bugs: ASTERISK-24190
>     https://issues.asterisk.org/jira/browse/ASTERISK-24190
> 
> 
> Repository: Asterisk
> 
> 
> Description
> -------
> 
> In update_messages_by_imapuser(), messages were appended without checking bounds:
> 
>     vms->msgArray[vms->vmArrayIndex++] = number;
> 
> This patch ensures that there is enough room.
> 
> 
> However, I did find quirky usage of thread local storage which I couldn't explain. Perhaps someone else can shed some light on the XXX's that I left in the code:
> 
> - vms is thread-local, so it may not need to be freed. But on line 3033, it is overwritten if (strcmp(vms_p->imapuser, vmu->imapuser) || strcmp(vms_p->username, vmu->mailbox))
>   (or should it be freed in vmstate_delete?)
> 
> - in vmstate_insert, an alternative mailbox overwrites the supplied one, but no msgArray copying is done. That can't be right.
> 
> 
> Diffs
> -----
> 
>   /branches/1.8/apps/app_voicemail.c 426569 
> 
> Diff: https://reviewboard.asterisk.org/r/4126/diff/
> 
> 
> Testing
> -------
> 
> The reporter -- Nick Adams -- has run this patch in production for a number of months now, without issues.
> 
> 
> Thanks,
> 
> wdoekes
> 
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20141029/678e7401/attachment.html>