bounds checking (FSCORE-380)

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@13750 d0543943-73ff-0310-b7d9-9358b9ac24b2

diff --git a/src/switch_core_asr.c b/src/switch_core_asr.c
index 2d1499c51017d794ef21b23b8fda280653556319..44bfba333819bf4d6d7aa7e95e59aaf7c910a1e5 100644 (file)
--- a/src/switch_core_asr.c
+++ b/src/switch_core_asr.c
@@ -126,8 +126,8 @@ SWITCH_DECLARE(switch_status_t) switch_core_asr_load_grammar(switch_asr_handle_t
        if (!switch_strlen_zero(param_string)) {
                char *param[256] = { 0 };
                int i;
-               switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0])));
-               for (i = 0; param[i]; ++i) {
+               int argc = switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0])));
+               for (i = 0; i < argc && param[i]; ++i) {
                        char *param_pair[2] = { 0 };
                        if(switch_separate_string(param[i], '=', param_pair, (sizeof(param_pair) / sizeof(param_pair[0]))) == 2) {
                                switch_core_asr_text_param(ah, param_pair[0], param_pair[1]);

diff --git a/src/switch_core_speech.c b/src/switch_core_speech.c
index 178fb39a8cc1f3fe30697fafa388726280467e0d..25a8459c6a39d463cc1dc42ac751b64557ff6a25 100644 (file)
--- a/src/switch_core_speech.c
+++ b/src/switch_core_speech.c
@@ -137,8 +137,8 @@ SWITCH_DECLARE(switch_status_t) switch_core_speech_feed_tts(switch_speech_handle
        if (!switch_strlen_zero(param_string)) {
                char *param[256] = { 0 };
                int i;
-               switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0])));
-               for (i = 0; param[i]; ++i) {
+               int argc = switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0])));
+               for (i = 0; i < argc && param[i]; ++i) {
                        char *param_pair[2] = { 0 };
                        if(switch_separate_string(param[i], '=', param_pair, (sizeof(param_pair) / sizeof(param_pair[0]))) == 2) {
                                switch_core_speech_text_param_tts(sh, param_pair[0], param_pair[1]);