[svn-commits] rmudgett: branch 1.4 r921 - /branches/1.4/pri.c
SVN commits to the Digium repositories
svn-commits at lists.digium.com
Fri Jun 26 14:50:22 CDT 2009
Author: rmudgett
Date: Fri Jun 26 14:50:19 2009
New Revision: 921
URL: http://svn.asterisk.org/svn-view/libpri?view=rev&rev=921
Log:
Fix potential buffer overflow in pri_dump_info_str().
* Created pri_snprintf() to prevent buffer overflow in pri_dump_info_str().
* Extracted timer name to timer number table from pri_timer2idx() so
pri_dump_info_str() can use it.
Modified:
branches/1.4/pri.c
Modified: branches/1.4/pri.c
URL: http://svn.asterisk.org/svn-view/libpri/branches/1.4/pri.c?view=diff&rev=921&r1=920&r2=921
==============================================================================
--- branches/1.4/pri.c (original)
+++ branches/1.4/pri.c Fri Jun 26 14:50:19 2009
@@ -42,6 +42,52 @@
#include "pri_facility.h"
#include "pri_q921.h"
#include "pri_q931.h"
+
+#define PRI_BIT(a_bit) (1UL << (a_bit))
+#define PRI_ALL_SWITCHES 0xFFFFFFFF
+
+struct pri_timer_table {
+ const char *name;
+ enum PRI_TIMERS_AND_COUNTERS number;
+ unsigned long used_by;
+};
+
+/*!
+ * \note Sort the timer table entries in the order of the timer name so
+ * pri_dump_info_str() can display them in a consitent order.
+ */
+static const struct pri_timer_table pri_timer[] = {
+/* *INDENT-OFF* */
+ /* timer name timer number used by switches */
+ { "N200", PRI_TIMER_N200, PRI_ALL_SWITCHES },
+ { "N201", PRI_TIMER_N201, PRI_ALL_SWITCHES },
+ { "N202", PRI_TIMER_N202, PRI_ALL_SWITCHES },
+ { "K", PRI_TIMER_K, PRI_ALL_SWITCHES },
+ { "T200", PRI_TIMER_T200, PRI_ALL_SWITCHES },
+ { "T202", PRI_TIMER_T202, PRI_ALL_SWITCHES },
+ { "T203", PRI_TIMER_T203, PRI_ALL_SWITCHES },
+ { "T300", PRI_TIMER_T300, PRI_ALL_SWITCHES },
+ { "T301", PRI_TIMER_T301, PRI_ALL_SWITCHES },
+ { "T302", PRI_TIMER_T302, PRI_ALL_SWITCHES },
+ { "T303", PRI_TIMER_T303, PRI_ALL_SWITCHES },
+ { "T304", PRI_TIMER_T304, PRI_ALL_SWITCHES },
+ { "T305", PRI_TIMER_T305, PRI_ALL_SWITCHES },
+ { "T306", PRI_TIMER_T306, PRI_ALL_SWITCHES },
+ { "T307", PRI_TIMER_T307, PRI_ALL_SWITCHES },
+ { "T308", PRI_TIMER_T308, PRI_ALL_SWITCHES },
+ { "T309", PRI_TIMER_T309, PRI_ALL_SWITCHES },
+ { "T310", PRI_TIMER_T310, PRI_ALL_SWITCHES },
+ { "T313", PRI_TIMER_T313, PRI_ALL_SWITCHES },
+ { "T314", PRI_TIMER_T314, PRI_ALL_SWITCHES },
+ { "T316", PRI_TIMER_T316, PRI_ALL_SWITCHES },
+ { "T317", PRI_TIMER_T317, PRI_ALL_SWITCHES },
+ { "T318", PRI_TIMER_T318, PRI_ALL_SWITCHES },
+ { "T319", PRI_TIMER_T319, PRI_ALL_SWITCHES },
+ { "T320", PRI_TIMER_T320, PRI_ALL_SWITCHES },
+ { "T321", PRI_TIMER_T321, PRI_ALL_SWITCHES },
+ { "T322", PRI_TIMER_T322, PRI_ALL_SWITCHES },
+/* *INDENT-ON* */
+};
char *pri_node2str(int node)
{
@@ -93,17 +139,17 @@
}
/* Set timer values to standard defaults. Time is in ms. */
- ctrl->timers[PRI_TIMER_N200] = 3; /* Max numer of Q.921 retransmissions */
- ctrl->timers[PRI_TIMER_N202] = 3; /* Max numer of transmissions of the TEI identity request message */
- ctrl->timers[PRI_TIMER_K] = 7; /* Max number of outstanding I-frames */
- ctrl->timers[PRI_TIMER_T200] = 1000; /* Time between SABME's */
- ctrl->timers[PRI_TIMER_T202] = 10000; /* Min time between transmission of TEI Identity request messages */
- ctrl->timers[PRI_TIMER_T203] = 10000; /* Max time without exchanging packets */
- ctrl->timers[PRI_TIMER_T305] = 30000; /* Wait for DISCONNECT acknowledge */
- ctrl->timers[PRI_TIMER_T308] = 4000; /* Wait for RELEASE acknowledge */
- ctrl->timers[PRI_TIMER_T313] = 4000; /* Wait for CONNECT acknowledge, CPE side only */
- ctrl->timers[PRI_TIMER_TM20] = 2500; /* Max time awaiting XID response - Q.921 Appendix IV */
- ctrl->timers[PRI_TIMER_NM20] = 3; /* Number of XID retransmits - Q.921 Appendix IV */
+ ctrl->timers[PRI_TIMER_N200] = 3; /* Max numer of Q.921 retransmissions */
+ ctrl->timers[PRI_TIMER_N202] = 3; /* Max numer of transmissions of the TEI identity request message */
+ ctrl->timers[PRI_TIMER_K] = 7; /* Max number of outstanding I-frames */
+ ctrl->timers[PRI_TIMER_T200] = 1000; /* Time between SABME's */
+ ctrl->timers[PRI_TIMER_T202] = 10 * 1000; /* Min time between transmission of TEI Identity request messages */
+ ctrl->timers[PRI_TIMER_T203] = 10 * 1000; /* Max time without exchanging packets */
+ ctrl->timers[PRI_TIMER_T305] = 30 * 1000; /* Wait for DISCONNECT acknowledge */
+ ctrl->timers[PRI_TIMER_T308] = 4 * 1000; /* Wait for RELEASE acknowledge */
+ ctrl->timers[PRI_TIMER_T313] = 4 * 1000; /* Wait for CONNECT acknowledge, CPE side only */
+ ctrl->timers[PRI_TIMER_TM20] = 2500; /* Max time awaiting XID response - Q.921 Appendix IV */
+ ctrl->timers[PRI_TIMER_NM20] = 3; /* Number of XID retransmits - Q.921 Appendix IV */
/* Set any switch specific override default values */
switch (switchtype) {
@@ -139,48 +185,13 @@
int pri_timer2idx(const char *timer_name)
{
- static const struct {
- const char *name;
- int number;
- } timer[] = {
-/* *INDENT-OFF* */
- { "N200", PRI_TIMER_N200 },
- { "N201", PRI_TIMER_N201 },
- { "N202", PRI_TIMER_N202 },
- { "K", PRI_TIMER_K },
- { "T200", PRI_TIMER_T200 },
- { "T202", PRI_TIMER_T202 },
- { "T203", PRI_TIMER_T203 },
- { "T300", PRI_TIMER_T300 },
- { "T301", PRI_TIMER_T301 },
- { "T302", PRI_TIMER_T302 },
- { "T303", PRI_TIMER_T303 },
- { "T304", PRI_TIMER_T304 },
- { "T305", PRI_TIMER_T305 },
- { "T306", PRI_TIMER_T306 },
- { "T307", PRI_TIMER_T307 },
- { "T308", PRI_TIMER_T308 },
- { "T309", PRI_TIMER_T309 },
- { "T310", PRI_TIMER_T310 },
- { "T313", PRI_TIMER_T313 },
- { "T314", PRI_TIMER_T314 },
- { "T316", PRI_TIMER_T316 },
- { "T317", PRI_TIMER_T317 },
- { "T318", PRI_TIMER_T318 },
- { "T319", PRI_TIMER_T319 },
- { "T320", PRI_TIMER_T320 },
- { "T321", PRI_TIMER_T321 },
- { "T322", PRI_TIMER_T322 },
-/* *INDENT-ON* */
- };
-
unsigned idx;
- int timer_number;
+ enum PRI_TIMERS_AND_COUNTERS timer_number;
timer_number = -1;
- for (idx = 0; idx < ARRAY_LEN(timer); ++idx) {
- if (!strcasecmp(timer_name, timer[idx].name)) {
- timer_number = timer[idx].number;
+ for (idx = 0; idx < ARRAY_LEN(pri_timer); ++idx) {
+ if (!strcasecmp(timer_name, pri_timer[idx].name)) {
+ timer_number = pri_timer[idx].number;
break;
}
}
@@ -846,49 +857,102 @@
return pri->fd;
}
-char *pri_dump_info_str(struct pri *pri)
-{
- char buf[4096];
- int len = 0;
+/*!
+ * \internal
+ * \brief Append snprintf output to the given buffer.
+ *
+ * \param buf Buffer currently filling.
+ * \param buf_used Offset into buffer where to put new stuff.
+ * \param buf_size Actual buffer size of buf.
+ * \param format printf format string.
+ *
+ * \return Total buffer space used.
+ */
+static size_t pri_snprintf(char *buf, size_t buf_used, size_t buf_size, const char *format, ...) __attribute__((format(printf, 4, 5)));
+static size_t pri_snprintf(char *buf, size_t buf_used, size_t buf_size, const char *format, ...)
+{
+ va_list args;
+
+ if (buf_used < buf_size) {
+ va_start(args, format);
+ buf_used += vsnprintf(buf + buf_used, buf_size - buf_used, format, args);
+ va_end(args);
+ }
+ if (buf_size < buf_used) {
+ buf_used = buf_size + 1;
+ }
+ return buf_used;
+}
+
+char *pri_dump_info_str(struct pri *ctrl)
+{
+ char *buf;
+ size_t buf_size;
+ size_t used;
#ifdef LIBPRI_COUNTERS
struct q921_frame *f;
- int q921outstanding = 0;
+ unsigned q921outstanding;
#endif
- if (!pri)
+ unsigned idx;
+ unsigned long switch_bit;
+
+ if (!ctrl) {
return NULL;
+ }
+
+ buf_size = 4096; /* This should be bigger than we will ever need. */
+ buf = malloc(buf_size);
+ if (!buf) {
+ return NULL;
+ }
/* Might be nice to format these a little better */
- len += sprintf(buf + len, "Switchtype: %s\n", pri_switch2str(pri->switchtype));
- len += sprintf(buf + len, "Type: %s\n", pri_node2str(pri->localtype));
+ used = 0;
+ used = pri_snprintf(buf, used, buf_size, "Switchtype: %s\n",
+ pri_switch2str(ctrl->switchtype));
+ used = pri_snprintf(buf, used, buf_size, "Type: %s\n", pri_node2str(ctrl->localtype));
#ifdef LIBPRI_COUNTERS
/* Remember that Q921 Counters include Q931 packets (and any retransmissions) */
- len += sprintf(buf + len, "Q931 RX: %d\n", pri->q931_rxcount);
- len += sprintf(buf + len, "Q931 TX: %d\n", pri->q931_txcount);
- len += sprintf(buf + len, "Q921 RX: %d\n", pri->q921_rxcount);
- len += sprintf(buf + len, "Q921 TX: %d\n", pri->q921_txcount);
- f = pri->txqueue;
+ used = pri_snprintf(buf, used, buf_size, "Q931 RX: %d\n", ctrl->q931_rxcount);
+ used = pri_snprintf(buf, used, buf_size, "Q931 TX: %d\n", ctrl->q931_txcount);
+ used = pri_snprintf(buf, used, buf_size, "Q921 RX: %d\n", ctrl->q921_rxcount);
+ used = pri_snprintf(buf, used, buf_size, "Q921 TX: %d\n", ctrl->q921_txcount);
+ q921outstanding = 0;
+ f = ctrl->txqueue;
while (f) {
q921outstanding++;
f = f->next;
}
- len += sprintf(buf + len, "Q921 Outstanding: %d\n", q921outstanding);
+ used = pri_snprintf(buf, used, buf_size, "Q921 Outstanding: %u\n", q921outstanding);
#endif
- len += sprintf(buf + len, "Window Length: %d/%d\n", pri->windowlen, pri->window);
- len += sprintf(buf + len, "Sentrej: %d\n", pri->sentrej);
- len += sprintf(buf + len, "SolicitFbit: %d\n", pri->solicitfbit);
- len += sprintf(buf + len, "Retrans: %d\n", pri->retrans);
- len += sprintf(buf + len, "Busy: %d\n", pri->busy);
- len += sprintf(buf + len, "Overlap Dial: %d\n", pri->overlapdial);
- len += sprintf(buf + len, "Logical Channel Mapping: %d\n", pri->chan_mapping_logical);
- len += sprintf(buf + len, "T200 Timer: %d\n", pri->timers[PRI_TIMER_T200]);
- len += sprintf(buf + len, "T203 Timer: %d\n", pri->timers[PRI_TIMER_T203]);
- len += sprintf(buf + len, "T305 Timer: %d\n", pri->timers[PRI_TIMER_T305]);
- len += sprintf(buf + len, "T308 Timer: %d\n", pri->timers[PRI_TIMER_T308]);
- len += sprintf(buf + len, "T309 Timer: %d\n", pri->timers[PRI_TIMER_T309]);
- len += sprintf(buf + len, "T313 Timer: %d\n", pri->timers[PRI_TIMER_T313]);
- len += sprintf(buf + len, "N200 Counter: %d\n", pri->timers[PRI_TIMER_N200]);
-
- return strdup(buf);
+ used = pri_snprintf(buf, used, buf_size, "Window Length: %d/%d\n", ctrl->windowlen,
+ ctrl->window);
+ used = pri_snprintf(buf, used, buf_size, "Sentrej: %d\n", ctrl->sentrej);
+ used = pri_snprintf(buf, used, buf_size, "SolicitFbit: %d\n", ctrl->solicitfbit);
+ used = pri_snprintf(buf, used, buf_size, "Retrans: %d\n", ctrl->retrans);
+ used = pri_snprintf(buf, used, buf_size, "Busy: %d\n", ctrl->busy);
+ used = pri_snprintf(buf, used, buf_size, "Overlap Dial: %d\n", ctrl->overlapdial);
+ used = pri_snprintf(buf, used, buf_size, "Logical Channel Mapping: %d\n",
+ ctrl->chan_mapping_logical);
+ used = pri_snprintf(buf, used, buf_size, "Timer and counter settings:\n");
+ switch_bit = PRI_BIT(ctrl->switchtype);
+ for (idx = 0; idx < ARRAY_LEN(pri_timer); ++idx) {
+ if (pri_timer[idx].used_by & switch_bit) {
+ enum PRI_TIMERS_AND_COUNTERS tmr;
+
+ tmr = pri_timer[idx].number;
+ if (0 <= ctrl->timers[tmr] || tmr == PRI_TIMER_T309) {
+ used = pri_snprintf(buf, used, buf_size, " %s: %d\n",
+ pri_timer[idx].name, ctrl->timers[tmr]);
+ }
+ }
+ }
+
+ if (buf_size < used) {
+ pri_message(ctrl,
+ "pri_dump_info_str(): Produced output exceeded buffer capacity. (Truncated)\n");
+ }
+ return buf;
}
int pri_get_crv(struct pri *pri, q931_call *call, int *callmode)
More information about the svn-commits
mailing list