[Asterisk-cvs] asterisk/channels chan_sip.c,1.510.2.67,1.510.2.68

[russell at lists.digium.com]

Update of /usr/cvsroot/asterisk/channels
In directory mongoose.digium.com:/tmp/cvs-serv12748/channels

Modified Files:
      Tag: v1-0
	chan_sip.c 
Log Message:
fix bounds checking (bug #4406)


Index: chan_sip.c
===================================================================
RCS file: /usr/cvsroot/asterisk/channels/chan_sip.c,v
retrieving revision 1.510.2.67
retrieving revision 1.510.2.68
diff -u -d -r1.510.2.67 -r1.510.2.68
--- chan_sip.c	13 Jun 2005 20:35:15 -0000	1.510.2.67
+++ chan_sip.c	14 Jun 2005 20:30:47 -0000	1.510.2.68
@@ -2234,8 +2234,10 @@
 			}
             if ((p->dtmfmode & SIP_DTMF_INBAND) && p->vad) {
                    f = ast_dsp_process(p->owner,p->vad,f);
-		   if (f && (f->frametype == AST_FRAME_DTMF)) 
+		   if (f && (f->frametype == AST_FRAME_DTMF)) {
 			ast_log(LOG_DEBUG, "Detected DTMF '%c'\n", f->subclass);
+			ast_log(LOG_NOTICE, "Detected inband DTMF '%c'\n", f->subclass);
+		   }
             }
 		}
 	}
@@ -2821,54 +2823,52 @@
 /*--- add_header: Add header to SIP message */
 static int add_header(struct sip_request *req, char *var, char *value)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+	if (req->headers == SIP_MAX_HEADERS) {
+		ast_log(LOG_WARNING, "Out of SIP header space\n");
 		return -1;
 	}
 	if (req->lines) {
 		ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
 		return -1;
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+		return -1;
+	}
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len - 4, "%s: %s\r\n", var, value);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else {
-		ast_log(LOG_WARNING, "Out of header space\n");
-		return -1;
-	}
+	req->headers++;
 	return 0;	
 }
 
 /*--- add_blank_header: Add blank header to SIP message */
 static int add_blank_header(struct sip_request *req)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+	if (req->headers == SIP_MAX_HEADERS)  {
+		ast_log(LOG_WARNING, "Out of SIP header space\n");
 		return -1;
 	}
 	if (req->lines) {
 		ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
 		return -1;
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+		return -1;
+	}
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "\r\n");
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else {
-		ast_log(LOG_WARNING, "Out of header space\n");
-		return -1;
-	}
+	req->headers++;
 	return 0;	
 }
 
 /*--- add_line: Add content (not header) to SIP message */
 static int add_line(struct sip_request *req, char *line)
 {
-	if (req->len >= sizeof(req->data) - 4) {
-		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+	if (req->lines == SIP_MAX_LINES) {
+		ast_log(LOG_WARNING, "Out of line space\n");
 		return -1;
 	}
 	if (!req->lines) {
@@ -2876,15 +2876,14 @@
 		snprintf(req->data + req->len, sizeof(req->data) - req->len, "\r\n");
 		req->len += strlen(req->data + req->len);
 	}
+	if (req->len >= sizeof(req->data) - 4) {
+		ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+		return -1;
+	}
 	req->line[req->lines] = req->data + req->len;
 	snprintf(req->line[req->lines], sizeof(req->data) - req->len, "%s", line);
 	req->len += strlen(req->line[req->lines]);
-	if (req->lines < SIP_MAX_LINES)
-		req->lines++;
-	else {
-		ast_log(LOG_WARNING, "Out of line space\n");
-		return -1;
-	}
+	req->lines++;
 	return 0;	
 }
 
@@ -3060,10 +3059,7 @@
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "SIP/2.0 %s\r\n", resp);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else
-		ast_log(LOG_WARNING, "Out of header space\n");
+	req->headers++;
 	return 0;
 }
 
@@ -3078,10 +3074,7 @@
 	req->header[req->headers] = req->data + req->len;
 	snprintf(req->header[req->headers], sizeof(req->data) - req->len, "%s %s SIP/2.0\r\n", resp, recip);
 	req->len += strlen(req->header[req->headers]);
-	if (req->headers < SIP_MAX_HEADERS)
-		req->headers++;
-	else
-		ast_log(LOG_WARNING, "Out of header space\n");
+	req->headers++;
 	return 0;
 }