[mod_rayo] Fix heap use after free and a possible buffer overflow.

diff --git a/src/mod/event_handlers/mod_rayo/mod_rayo.c b/src/mod/event_handlers/mod_rayo/mod_rayo.c
index 25ab87b97586df20a6934d13c35293160afc1801..b2e3ef2734604fdcf34fd18bcdf2e2d8d0405028 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/mod_rayo.c
+++ b/src/mod/event_handlers/mod_rayo/mod_rayo.c
@@ -4854,7 +4854,7 @@ static int alias_api(struct rayo_cmd_alias *alias, char *args, switch_stream_han
        cmd = strdup(alias->cmd);
        for (i = 1; i < argc; i++) {
                char *cmd_new;
-               char to_replace[4] = { 0 };
+               char to_replace[12] = { 0 };
                sprintf(to_replace, "$%i", i);
                cmd_new = switch_string_replace(cmd, to_replace, argv[i]);
                free(cmd);

diff --git a/src/mod/event_handlers/mod_rayo/srgs.c b/src/mod/event_handlers/mod_rayo/srgs.c
index 6a3111704fbb4d2c422aa10e2626d2f8aa479fe7..7981c24ef2e63815faeabfa6b0a3aaff68b1bbdc 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/srgs.c
+++ b/src/mod/event_handlers/mod_rayo/srgs.c
@@ -851,8 +851,8 @@ static void srgs_grammar_destroy(struct srgs_grammar *grammar)
        if (grammar->jsgf_file_name) {
                switch_file_remove(grammar->jsgf_file_name, pool);
        }
-       switch_core_destroy_memory_pool(&pool);
        switch_core_hash_destroy(&grammar->rules);
+       switch_core_destroy_memory_pool(&pool);
 }
 
 /**