[svn-commits] rmudgett: trunk r417120 - in /trunk: ./ main/core_unreal.c

[SVN commits to the Digium repositories]

Author: rmudgett
Date: Mon Jun 23 11:04:33 2014
New Revision: 417120

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=417120
Log:
core_unreal: Fix off by one buffer overwrite error.

Appending the ;2 to the user supplied ;1 uniqueid to create the ;2 version
if the user did not also supply an extra uniqueid for the ;2 channel
resulted in allocating a buffer that was one byte too small.

* Fix off by one error in ast_unreal_new_channels() when generating the ;2
uniqueid from the user suppled ;1 version.

* Pulled some long assignment lines from if tests to improve line break
readability in ast_unreal_new_channels().
........

Merged revisions 417119 from http://svn.asterisk.org/svn/asterisk/branches/12

Modified:
    trunk/   (props changed)
    trunk/main/core_unreal.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-12-merged' - no diff available.

Modified: trunk/main/core_unreal.c
URL: http://svnview.digium.com/svn/asterisk/trunk/main/core_unreal.c?view=diff&rev=417120&r1=417119&r2=417120
==============================================================================
--- trunk/main/core_unreal.c (original)
+++ trunk/main/core_unreal.c Mon Jun 23 11:04:33 2014
@@ -911,7 +911,7 @@
 	if (id1.uniqueid && ast_strlen_zero(id2.uniqueid)) {
 		char *uniqueid2;
 
-		uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 2);
+		uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 3);
 		strcpy(uniqueid2, id1.uniqueid);/* Safe */
 		strcat(uniqueid2, ";2");/* Safe */
 		id2.uniqueid = uniqueid2;
@@ -924,9 +924,10 @@
 	 * You can't pass linkedid to both allocations since if linkedid
 	 * isn't set, then each channel will generate its own linkedid.
 	 */
-	if (!(owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
-			exten, context, &id1, requestor, 0,
-			"%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno))) {
+	owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
+		exten, context, &id1, requestor, 0,
+		"%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno);
+	if (!owner) {
 		ast_log(LOG_WARNING, "Unable to allocate owner channel structure\n");
 		return NULL;
 	}
@@ -964,9 +965,10 @@
 	p->owner = owner;
 	ast_channel_unlock(owner);
 
-	if (!(chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
-			exten, context, &id2, owner, 0,
-			"%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno))) {
+	chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
+		exten, context, &id2, owner, 0,
+		"%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno);
+	if (!chan) {
 		ast_log(LOG_WARNING, "Unable to allocate chan channel structure\n");
 		ao2_ref(p, -1);
 		ast_channel_tech_pvt_set(owner, NULL);