<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://reviewboard.asterisk.org/r/2161/">https://reviewboard.asterisk.org/r/2161/</a>
</td>
</tr>
</table>
<br />
<p>Ship it!</p>
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Compilers don't lie.</pre>
<br />
<p>- rmudgett</p>
<br />
<p>On October 12th, 2012, 1:41 p.m., Mark Michelson wrote:</p>
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('https://reviewboard.asterisk.org/media/rb/images/review_request_box_top_bg.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
<tr>
<td>
<div>Review request for Asterisk Developers.</div>
<div>By Mark Michelson.</div>
<p style="color: grey;"><i>Updated Oct. 12, 2012, 1:41 p.m.</i></p>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">While writing the TCP tests for https://reviewboard.asterisk.org/r/2123 I accidentally misused ast_str when writing the test. I corrected my error and then realized it may be being misused other places in the code. Here's an example of the misuse I'm referring to:
int foo(struct ast_str *str)
{
ast_str_set(&str, 0, "%s", some_string);
}
int bar(void)
{
struct ast_str *str = ast_str_create(32);
foo(str);
do_something(str); /* DANGEROUS */
}
So let's go through this.
1) bar() creates an ast_str and calls foo().
2) foo() sets the ast_str to some value using ast_str_set().
3) ast_str_set() takes a pointer to the ast_str pointer because the ast_str can be reallocated. If this reallocation occurs, then when control returns to foo(), its version of str is pointing to invalid data.
The fix is to either
1) Pass a struct (or other container) with the ast_str pointer to foo()
2) Pass a pointer to the ast_str pointer to foo()
In the cases changed in this diff, the second approach was taken since the ast_str pointers did not already belong to some struct.
While there are changes in app_dial.c, chan_iax2.c, and ccss.c, the only one that can be problematic in its current state is ccss.c. This is because in app_dial and chan_iax2, the ast_strs are created using ast_str_alloca() instead of ast_str_create(). This means they cannot be reallocated by a call to ast_str_set(). I elected to make the changes in app_dial and chan_iax2 because the functions as they exist have the potential for danger and should be made safer.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Compiles, brah!</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>/branches/1.8/apps/app_dial.c <span style="color: grey">(374904)</span></li>
<li>/branches/1.8/channels/chan_iax2.c <span style="color: grey">(374904)</span></li>
<li>/branches/1.8/main/ccss.c <span style="color: grey">(374904)</span></li>
</ul>
<p><a href="https://reviewboard.asterisk.org/r/2161/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>