]> git.ipfire.org Git - thirdparty/asterisk.git/commit
AST-2012-005: Fix remotely exploitable heap overflow in keypad button handling
authorMatthew Jordan <mjordan@digium.com>
Mon, 23 Apr 2012 13:30:50 +0000 (13:30 +0000)
committerMatthew Jordan <mjordan@digium.com>
Mon, 23 Apr 2012 13:30:50 +0000 (13:30 +0000)
commit5991853759c04f6e5592095ba3cf6b395fc32f9e
treeaee9dbf9db7bac39baca76592cd17a862fbb5ab6
parent84e00510c4982cf82ec8da25c24015e9bb859878
AST-2012-005: Fix remotely exploitable heap overflow in keypad button handling

When handling a keypad button message event, the received digit is placed into
a fixed length buffer that acts as a queue.  When a new message event is
received, the length of that buffer is not checked before placing the new digit
on the end of the queue.  The situation exists where sufficient keypad button
message events would occur that would cause the buffer to be overrun.  This
patch explicitly checks that there is sufficient room in the buffer before
appending a new digit.

(closes issue ASTERISK-19592)
Reported by: Russell Bryant

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.2@363100 65c4cc65-6c06-0410-ace0-fbb531ad65f3
channels/chan_skinny.c