AST-2009-005

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@211539 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1 files changed, 22 insertions, 10 deletions

diff --git a/apps/app_rpt.c b/apps/app_rpt.c
index 0aa20e000..07721c2a5 100644
--- a/apps/app_rpt.c
+++ b/apps/app_rpt.c
@@ -2106,7 +2106,7 @@ static int myatoi(const char *str)
 	}
 
 	/* leave this %i alone, non-base-10 input is useful here */
-	if (sscanf(str, "%i", &ret) != 1) {
+	if (sscanf(str, "%30i", &ret) != 1) {
 		return -1;
 	}
 
@@ -2333,7 +2333,7 @@ static char *cs_keywords[] = {"rptena","rptdis","apena","apdis","lnkena","lnkdis
 	/* do not use atoi() here, we need to be able to have
 		the input specified in hex or decimal so we use
 		sscanf with a %i */
-	if ((!val) || (sscanf(val,"%i",&rpt_vars[n].p.iobase) != 1))
+	if ((!val) || (sscanf(val,"%30i",&rpt_vars[n].p.iobase) != 1))
 		rpt_vars[n].p.iobase = DEFAULT_IOBASE;
 	val = (char *) ast_variable_retrieve(cfg,this,"ioport");
 	rpt_vars[n].p.ioport = val;
@@ -3650,7 +3650,7 @@ static int send_tone_telemetry(struct ast_channel *chan, char *tonestring)
 		tonesubset = strsep(&stringp,")");
 		if(!tonesubset)
 			break;
-		if(sscanf(tonesubset,"(%d,%d,%d,%d", &f1, &f2, &duration, &amplitude) != 4)
+		if(sscanf(tonesubset,"(%30d,%30d,%30d,%30d", &f1, &f2, &duration, &amplitude) != 4)
 			break;
 		res = play_tone_pair(chan, f1, f2, duration, amplitude);
 		if(res)
@@ -5072,7 +5072,7 @@ struct dahdi_params par;
 		p = strstr(tdesc, "version");	
 		if(!p)
 			break;	
-		if(sscanf(p, "version %d.%d", &vmajor, &vminor) != 2)
+		if(sscanf(p, "version %30d.%30d", &vmajor, &vminor) != 2)
 			break;
     		wait_interval(myrpt, DLY_TELEM, mychannel); /* Wait a little bit */
 		/* Say "version" */
@@ -6680,6 +6680,8 @@ static int collect_function_digits(struct rpt *myrpt, char *digits,
 static void handle_link_data(struct rpt *myrpt, struct rpt_link *mylink,
 	char *str)
 {
+/* XXX ATTENTION: if you change the size of these arrays you MUST
+ * change the limits in corresponding sscanf() calls below. */
 char	tmp[512],tmp1[512],cmd[300] = "",dest[300],src[300],c;
 int	i,seq, res, ts;
 struct rpt_link *l;
@@ -6718,7 +6720,7 @@ struct	ast_frame wf;
 	}
 	if (tmp[0] == 'K')
 	{
-		if (sscanf(tmp,"%s %s %s %d %d",cmd,dest,src,&seq,&ts) != 5)
+		if (sscanf(tmp, "%299s %299s %299s %30d %30d", cmd, dest, src, &seq, &ts) != 5)
 		{
 			ast_log(LOG_WARNING, "Unable to parse keying string %s\n",str);
 			return;
@@ -6826,7 +6828,9 @@ struct	ast_frame wf;
 	}
 	if (tmp[0] == 'I')
 	{
-		if (sscanf(tmp,"%s %s %x",cmd,src,&seq) != 3)
+		/* XXX WARNING: be very careful with the limits on the folowing
+		 * sscanf() call, make sure they match the values defined above */
+		if (sscanf(tmp,"%299s %299s %30x",cmd,src,&seq) != 3)
 		{
 			ast_log(LOG_WARNING, "Unable to parse ident string %s\n",str);
 			return;
@@ -6836,7 +6840,9 @@ struct	ast_frame wf;
 	}
 	else
 	{
-		if (sscanf(tmp,"%s %s %s %d %c",cmd,dest,src,&seq,&c) != 5)
+		/* XXX WARNING: be very careful with the limits on the folowing
+		 * sscanf() call, make sure they match the values defined above */
+		if (sscanf(tmp,"%299s %299s %299s %30d %1c",cmd,dest,src,&seq,&c) != 5)
 		{
 			ast_log(LOG_WARNING, "Unable to parse link string %s\n",str);
 			return;
@@ -10231,6 +10237,8 @@ int	ret,res = 0,src;
 
 static int handle_remote_data(struct rpt *myrpt, char *str)
 {
+/* XXX ATTENTION: if you change the size of these arrays you MUST
+ * change the limits in corresponding sscanf() calls below. */
 char	tmp[300],cmd[300],dest[300],src[300],c;
 int	seq,res;
 
@@ -10246,7 +10254,9 @@ int	seq,res;
 #ifndef	DO_NOT_NOTIFY_MDC1200_ON_REMOTE_BASES
 	if (tmp[0] == 'I')
 	{
-		if (sscanf(tmp,"%s %s %x",cmd,src,&seq) != 3)
+		/* XXX WARNING: be very careful with the limits on the folowing
+		 * sscanf() call, make sure they match the values defined above */
+		if (sscanf(tmp,"%299s %299s %30x",cmd,src,&seq) != 3)
 		{
 			ast_log(LOG_WARNING, "Unable to parse ident string %s\n",str);
 			return 0;
@@ -10255,7 +10265,9 @@ int	seq,res;
 		return 0;
 	}
 #endif
-	if (sscanf(tmp,"%s %s %s %d %c",cmd,dest,src,&seq,&c) != 5)
+	/* XXX WARNING: be very careful with the limits on the folowing
+	 * sscanf() call, make sure they match the values defined above */
+	if (sscanf(tmp,"%299s %299s %299s %30d %1c",cmd,dest,src,&seq,&c) != 5)
 	{
 		ast_log(LOG_WARNING, "Unable to parse link string %s\n",str);
 		return 0;
@@ -11886,7 +11898,7 @@ char tmpstr[300],lstr[MAXLINKLIST];
                 	p = strstr(tdesc, "version");
                 	if(p){
 				int vmajor,vminor;
-				if(sscanf(p, "version %d.%d", &vmajor, &vminor) == 2)
+				if(sscanf(p, "version %30d.%30d", &vmajor, &vminor) == 2)
 					sprintf(str + strlen(str),"&apprptvers=%d.%d",vmajor,vminor);
 			}
 			time(&now);