Skinny: Don't do backspace if destination number is already empty

This fix a out of bound memory write.
(normally unreachable with a real phone)

diff --git a/src/mod/endpoints/mod_skinny/skinny_server.c b/src/mod/endpoints/mod_skinny/skinny_server.c
index 00ec6fa56b49b6a47cba1e1a272d26713258fb74..8e47691c36647c260dbb71b9fc5972fd114abf28 100644 (file)
--- a/src/mod/endpoints/mod_skinny/skinny_server.c
+++ b/src/mod/endpoints/mod_skinny/skinny_server.c
@@ -271,7 +271,7 @@ switch_status_t skinny_session_process_dest(switch_core_session_t *session, list
                if (strlen(tech_pvt->caller_profile->destination_number) == 0) {/* no digit yet */
                        send_start_tone(listener, SKINNY_TONE_DIALTONE, 0, line_instance, tech_pvt->call_id);
                }
-               if (backspace) { /* backspace */
+               if (backspace && strlen(tech_pvt->caller_profile->destination_number)) { /* backspace */
                        tech_pvt->caller_profile->destination_number[strlen(tech_pvt->caller_profile->destination_number)-1] = '\0';
                        if (strlen(tech_pvt->caller_profile->destination_number) == 0) {
                                send_select_soft_keys(listener, line_instance, tech_pvt->call_id, SKINNY_KEY_SET_OFF_HOOK, 0xffff);