From 642bec4d6fea7afad99b6a4853418081137a48ba Mon Sep 17 00:00:00 2001 From: Tilghman Lesher Date: Mon, 10 Aug 2009 19:20:57 +0000 Subject: AST-2009-005 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@211539 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- apps/app_rpt.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) (limited to 'apps/app_rpt.c') diff --git a/apps/app_rpt.c b/apps/app_rpt.c index 0aa20e000..07721c2a5 100644 --- a/apps/app_rpt.c +++ b/apps/app_rpt.c @@ -2106,7 +2106,7 @@ static int myatoi(const char *str) } /* leave this %i alone, non-base-10 input is useful here */ - if (sscanf(str, "%i", &ret) != 1) { + if (sscanf(str, "%30i", &ret) != 1) { return -1; } @@ -2333,7 +2333,7 @@ static char *cs_keywords[] = {"rptena","rptdis","apena","apdis","lnkena","lnkdis /* do not use atoi() here, we need to be able to have the input specified in hex or decimal so we use sscanf with a %i */ - if ((!val) || (sscanf(val,"%i",&rpt_vars[n].p.iobase) != 1)) + if ((!val) || (sscanf(val,"%30i",&rpt_vars[n].p.iobase) != 1)) rpt_vars[n].p.iobase = DEFAULT_IOBASE; val = (char *) ast_variable_retrieve(cfg,this,"ioport"); rpt_vars[n].p.ioport = val; @@ -3650,7 +3650,7 @@ static int send_tone_telemetry(struct ast_channel *chan, char *tonestring) tonesubset = strsep(&stringp,")"); if(!tonesubset) break; - if(sscanf(tonesubset,"(%d,%d,%d,%d", &f1, &f2, &duration, &litude) != 4) + if(sscanf(tonesubset,"(%30d,%30d,%30d,%30d", &f1, &f2, &duration, &litude) != 4) break; res = play_tone_pair(chan, f1, f2, duration, amplitude); if(res) @@ -5072,7 +5072,7 @@ struct dahdi_params par; p = strstr(tdesc, "version"); if(!p) break; - if(sscanf(p, "version %d.%d", &vmajor, &vminor) != 2) + if(sscanf(p, "version %30d.%30d", &vmajor, &vminor) != 2) break; wait_interval(myrpt, DLY_TELEM, mychannel); /* Wait a little bit */ /* Say "version" */ @@ -6680,6 +6680,8 @@ static int collect_function_digits(struct rpt *myrpt, char *digits, static void handle_link_data(struct rpt *myrpt, struct rpt_link *mylink, char *str) { +/* XXX ATTENTION: if you change the size of these arrays you MUST + * change the limits in corresponding sscanf() calls below. */ char tmp[512],tmp1[512],cmd[300] = "",dest[300],src[300],c; int i,seq, res, ts; struct rpt_link *l; @@ -6718,7 +6720,7 @@ struct ast_frame wf; } if (tmp[0] == 'K') { - if (sscanf(tmp,"%s %s %s %d %d",cmd,dest,src,&seq,&ts) != 5) + if (sscanf(tmp, "%299s %299s %299s %30d %30d", cmd, dest, src, &seq, &ts) != 5) { ast_log(LOG_WARNING, "Unable to parse keying string %s\n",str); return; @@ -6826,7 +6828,9 @@ struct ast_frame wf; } if (tmp[0] == 'I') { - if (sscanf(tmp,"%s %s %x",cmd,src,&seq) != 3) + /* XXX WARNING: be very careful with the limits on the folowing + * sscanf() call, make sure they match the values defined above */ + if (sscanf(tmp,"%299s %299s %30x",cmd,src,&seq) != 3) { ast_log(LOG_WARNING, "Unable to parse ident string %s\n",str); return; @@ -6836,7 +6840,9 @@ struct ast_frame wf; } else { - if (sscanf(tmp,"%s %s %s %d %c",cmd,dest,src,&seq,&c) != 5) + /* XXX WARNING: be very careful with the limits on the folowing + * sscanf() call, make sure they match the values defined above */ + if (sscanf(tmp,"%299s %299s %299s %30d %1c",cmd,dest,src,&seq,&c) != 5) { ast_log(LOG_WARNING, "Unable to parse link string %s\n",str); return; @@ -10231,6 +10237,8 @@ int ret,res = 0,src; static int handle_remote_data(struct rpt *myrpt, char *str) { +/* XXX ATTENTION: if you change the size of these arrays you MUST + * change the limits in corresponding sscanf() calls below. */ char tmp[300],cmd[300],dest[300],src[300],c; int seq,res; @@ -10246,7 +10254,9 @@ int seq,res; #ifndef DO_NOT_NOTIFY_MDC1200_ON_REMOTE_BASES if (tmp[0] == 'I') { - if (sscanf(tmp,"%s %s %x",cmd,src,&seq) != 3) + /* XXX WARNING: be very careful with the limits on the folowing + * sscanf() call, make sure they match the values defined above */ + if (sscanf(tmp,"%299s %299s %30x",cmd,src,&seq) != 3) { ast_log(LOG_WARNING, "Unable to parse ident string %s\n",str); return 0; @@ -10255,7 +10265,9 @@ int seq,res; return 0; } #endif - if (sscanf(tmp,"%s %s %s %d %c",cmd,dest,src,&seq,&c) != 5) + /* XXX WARNING: be very careful with the limits on the folowing + * sscanf() call, make sure they match the values defined above */ + if (sscanf(tmp,"%299s %299s %299s %30d %1c",cmd,dest,src,&seq,&c) != 5) { ast_log(LOG_WARNING, "Unable to parse link string %s\n",str); return 0; @@ -11886,7 +11898,7 @@ char tmpstr[300],lstr[MAXLINKLIST]; p = strstr(tdesc, "version"); if(p){ int vmajor,vminor; - if(sscanf(p, "version %d.%d", &vmajor, &vminor) == 2) + if(sscanf(p, "version %30d.%30d", &vmajor, &vminor) == 2) sprintf(str + strlen(str),"&apprptvers=%d.%d",vmajor,vminor); } time(&now); -- cgit v1.2.3