Resolve an invalid memory read on an event.

Valgrind pointed out that attempting to get an IE value from an event that has
no IEs produces an invalid memory read past the end of the event.  Thanks to
mmichelson for pointing the problem out to me and then testing the fix.

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@269417 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/event.h b/include/asterisk/event.h
index 727553c24d481cd2d1ca259e6dee9174e5508b47..12459fc9de1bb8d708b4735de837221150f2b24b 100644 (file)
--- a/include/asterisk/event.h
+++ b/include/asterisk/event.h
@@ -663,9 +663,10 @@ size_t ast_event_get_size(const struct ast_event *event);
  * \param iterator The iterator instance to initialize
  * \param event The event that will be iterated through
  *
- * \return Nothing
+ * \retval 0 Success, there are IEs available to iterate
+ * \retval -1 Failure, there are no IEs in the event to iterate
  */
-void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event);
+int ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event);
 
 /*!
  * \brief Move iterator instance to next IE

diff --git a/main/event.c b/main/event.c
index 51a3a45ab580598168483098bf70e960548ab7bd..23fd7af8e6a9169cba53087aedef76f44a5de00f 100644 (file)
--- a/main/event.c
+++ b/main/event.c
@@ -935,11 +935,20 @@ struct ast_event_sub *ast_event_unsubscribe(struct ast_event_sub *sub)
        return NULL;
 }
 
-void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
+int ast_event_iterator_init(struct ast_event_iterator *iterator, const struct ast_event *event)
 {
+       int res = 0;
+
        iterator->event_len = ast_event_get_size(event);
        iterator->event = event;
-       iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
+       if (iterator->event_len >= sizeof(*event) + sizeof(struct ast_event_ie)) {
+               iterator->ie = (struct ast_event_ie *) ( ((char *) event) + sizeof(*event) );
+       } else {
+               iterator->ie = NULL;
+               res = -1;
+       }
+
+       return res;
 }
 
 int ast_event_iterator_next(struct ast_event_iterator *iterator)
@@ -1021,9 +1030,9 @@ const char *ast_event_get_ie_str(const struct ast_event *event, enum ast_event_i
 const void *ast_event_get_ie_raw(const struct ast_event *event, enum ast_event_ie_type ie_type)
 {
        struct ast_event_iterator iterator;
-       int res = 0;
+       int res;
 
-       for (ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
+       for (res = ast_event_iterator_init(&iterator, event); !res; res = ast_event_iterator_next(&iterator)) {
                if (ast_event_iterator_get_ie_type(&iterator) == ie_type) {
                        return ast_event_iterator_get_ie_raw(&iterator);
                }