diff options
| author | Richard Mudgett <rmudgett@digium.com> | 2017-10-03 16:19:52 -0500 |
|---|---|---|
| committer | George Joseph <gjoseph@digium.com> | 2017-11-08 05:39:47 -0700 |
| commit | 9670040e2eac80978f4ecbc0cbae341adcbcf39b (patch) | |
| tree | f4581573340f3537801c2c02196d4c2c4e8d72e3 | |
| parent | 9c7c441a0fa70b4a5cbec4588f8a658c717849e5 (diff) | |
AST-2017-010: Fix cdr_object_update_party_b_userfield_cb() buf overrun
cdr_object_update_party_b_userfield_cb() could overrun the fixed buffer if
the supplied string is too long. The long string could be supplied by
external means using the CDR(userfield) function.
This may seem reminiscent to AST-2017-001 (ASTERISK_26897) and it is. The
earlier patch fixed the buffer overrun for Party A's userfield while this
patch fixes the same thing for Party B's userfield.
ASTERISK-27337
Change-Id: I0fa767f65ecec7e676ca465306ff9e0edbf3b652
| -rw-r--r-- | main/cdr.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/main/cdr.c b/main/cdr.c index 06cadcd8b..723d92a4c 100644 --- a/main/cdr.c +++ b/main/cdr.c @@ -3255,7 +3255,8 @@ static int cdr_object_update_party_b_userfield_cb(void *obj, void *arg, int flag } if (it_cdr->party_b.snapshot && !strcasecmp(it_cdr->party_b.snapshot->name, info->channel_name)) { - strcpy(it_cdr->party_b.userfield, info->userfield); + ast_copy_string(it_cdr->party_b.userfield, info->userfield, + sizeof(it_cdr->party_b.userfield)); } } return 0; @@ -3278,7 +3279,8 @@ void ast_cdr_setuserfield(const char *channel_name, const char *userfield) if (it_cdr->fn_table == &finalized_state_fn_table && it_cdr->next != NULL) { continue; } - ast_copy_string(it_cdr->party_a.userfield, userfield, AST_MAX_USER_FIELD); + ast_copy_string(it_cdr->party_a.userfield, userfield, + sizeof(it_cdr->party_a.userfield)); } ao2_unlock(cdr); } |