code analysis, bounds checks, buffer overrun fixes.

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@7403 d0543943-73ff-0310-b7d9-9358b9ac24b2

diff --git a/src/include/switch_apr.h b/src/include/switch_apr.h
index 0f0879fe144976fd04f22eed046ae7b369d877df..eb8854105537bb25d9a10ab839b56d834f465b82 100644 (file)
--- a/src/include/switch_apr.h
+++ b/src/include/switch_apr.h
@@ -125,11 +125,11 @@ SWITCH_DECLARE(const char *) switch_dso_error(switch_dso_handle_t * dso, char *b
  * @{
  */
 
-SWITCH_DECLARE(int) switch_snprintf(char *buf, switch_size_t len, const char *format, ...);
+SWITCH_DECLARE(int) switch_snprintf(_Out_z_cap_(len) char *buf, _In_ switch_size_t len, _In_z_ _Printf_format_string_ const char *format, ...);
 
-SWITCH_DECLARE(int) switch_vasprintf(char **buf, const char *format, va_list ap);
+SWITCH_DECLARE(int) switch_vasprintf(_Out_opt_ char **buf, _In_z_ _Printf_format_string_ const char *format, _In_ va_list ap);
 
-SWITCH_DECLARE(char *) switch_copy_string(char *dst, const char *src, switch_size_t dst_size);
+SWITCH_DECLARE(char *) switch_copy_string(_Out_z_cap_(dst_size) char *dst, _In_z_ const char *src, _In_ switch_size_t dst_size);
 
 /** @} */
 

diff --git a/src/include/switch_buffer.h b/src/include/switch_buffer.h
index 15514450e3fed9f846b6f2cda23c52adc76f3842..1a597e1bebaf3c847c251bf4d1e6b310f8e993c3 100644 (file)
--- a/src/include/switch_buffer.h
+++ b/src/include/switch_buffer.h
@@ -58,7 +58,7 @@ SWITCH_BEGIN_EXTERN_C
  * \param max_len length required by the buffer
  * \return status
  */
-SWITCH_DECLARE(switch_status_t) switch_buffer_create(switch_memory_pool_t *pool, switch_buffer_t **buffer, switch_size_t max_len);
+SWITCH_DECLARE(switch_status_t) switch_buffer_create(_In_ switch_memory_pool_t *pool, _Out_ switch_buffer_t **buffer, _In_ switch_size_t max_len);
 
 /*! \brief Allocate a new dynamic switch_buffer 
  * \param buffer returned pointer to the new buffer
@@ -67,8 +67,8 @@ SWITCH_DECLARE(switch_status_t) switch_buffer_create(switch_memory_pool_t *pool,
  * \param max_len length the buffer is allowed to grow to
  * \return status
  */
-SWITCH_DECLARE(switch_status_t) switch_buffer_create_dynamic(switch_buffer_t **buffer, switch_size_t blocksize, switch_size_t start_len,
-                                                                                                                        switch_size_t max_len);
+SWITCH_DECLARE(switch_status_t) switch_buffer_create_dynamic(_Out_ switch_buffer_t **buffer, _In_ switch_size_t blocksize, _In_ switch_size_t start_len,
+                                                                                                                        _In_ switch_size_t max_len);
 
 SWITCH_DECLARE(void) switch_buffer_add_mutex(_In_ switch_buffer_t *buffer, _In_ switch_mutex_t *mutex);
 SWITCH_DECLARE(void) switch_buffer_lock(_In_ switch_buffer_t *buffer);

diff --git a/src/include/switch_core.h b/src/include/switch_core.h
index 3a9fe68b87eb6d629bc3c86ca4706467667c2eb1..f97db7b50a5a0747f65b19b3b02f170168663605 100644 (file)
--- a/src/include/switch_core.h
+++ b/src/include/switch_core.h
@@ -867,14 +867,14 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_recv_dtmf(_In_ switch_core_s
   \param pool the pool to use for the new hash
   \return SWITCH_STATUS_SUCCESS if the hash is created
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_init(switch_hash_t ** hash, switch_memory_pool_t *pool);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_init(_Out_ switch_hash_t ** hash, _In_ switch_memory_pool_t *pool);
 
 /*! 
   \brief Destroy an existing hash table
   \param hash the hash to destroy
   \return SWITCH_STATUS_SUCCESS if the hash is destroyed
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(switch_hash_t **hash);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(_Inout_ switch_hash_t **hash);
 
 /*! 
   \brief Insert data into a hash
@@ -884,7 +884,7 @@ SWITCH_DECLARE(switch_status_t) switch_core_hash_destroy(switch_hash_t **hash);
   \return SWITCH_STATUS_SUCCESS if the data is added
   \note the string key must be a constant or a dynamic string
 */
-SWITCH_DECLARE(switch_status_t) switch_core_hash_insert(switch_hash_t * hash, const char *key, const void *data);
+SWITCH_DECLARE(switch_status_t) switch_core_hash_insert(_In_ switch_hash_t * hash, _In_z_ const char *key, _In_opt_ const void *data);
 
 /*! 
   \brief Insert data into a hash

diff --git a/src/include/switch_platform.h b/src/include/switch_platform.h
index 217f3fce10b3c6ace0010c2a2aa80d9dfd075f45..248f551fe57144f900737f86961092571a52961a 100644 (file)
--- a/src/include/switch_platform.h
+++ b/src/include/switch_platform.h
@@ -314,7 +314,11 @@ SWITCH_END_EXTERN_C
 #define _Inout_opt_
 #define _In_bytecount_(x)
 #define _Out_opt_bytecapcount_(x)
+#define _Out_bytecapcount_(x)
 #define _Ret_
+#define _Post_z_
+#define _Out_cap_(x)
+#define _Out_z_cap_(x)
 #endif
 
 

diff --git a/src/include/switch_utils.h b/src/include/switch_utils.h
index 4cfdec3483824add57fd5fc2310a4f07b5684b6c..aedbb3064668ce52274efed076ac4e005deb8b33 100644 (file)
--- a/src/include/switch_utils.h
+++ b/src/include/switch_utils.h
@@ -92,7 +92,7 @@ atoi(expr))) ? SWITCH_TRUE : SWITCH_FALSE
   \param family the address family to return (AF_INET or AF_INET6)
   \return SWITCH_STATUS_SUCCESSS for success, otherwise failure
 */
-SWITCH_DECLARE(switch_status_t) switch_find_local_ip(char *buf, int len, int family);
+SWITCH_DECLARE(switch_status_t) switch_find_local_ip(_Out_opt_bytecapcount_(len) char *buf, _In_ int len, _In_ int family);
 
 /*!
   \brief find the char representation of an ip adress

diff --git a/src/mod/applications/mod_voicemail/mod_voicemail.c b/src/mod/applications/mod_voicemail/mod_voicemail.c
index 127d3e0dd96815c791e1a613d2d1c41536c1ad50..5d9822c5eef7b0c9e0c6c07826d33ca1e5a30467 100644 (file)
--- a/src/mod/applications/mod_voicemail/mod_voicemail.c
+++ b/src/mod/applications/mod_voicemail/mod_voicemail.c
@@ -437,7 +437,7 @@ static switch_status_t load_config(void)
                                callback_dialplan = val;
                        } else if (!strcasecmp(var, "callback-context") && !switch_strlen_zero(val)) {
                                callback_context = val;
-                       } else if (!strcasecmp(var, "file-extension")) {
+                       } else if (!strcasecmp(var, "file-extension") && !switch_strlen_zero(val)) {
                                file_ext = val;
                        } else if (!strcasecmp(var, "record-title") && !switch_strlen_zero(val)) {
                                record_title = val;

diff --git a/src/mod/endpoints/mod_portaudio/mod_portaudio.c b/src/mod/endpoints/mod_portaudio/mod_portaudio.c
index 37c64fd9049ed78c7cc0934b9dc0b037bf6ce719..c3f5b2621fa964ec4b7420fbc9eda17add7f4f7c 100644 (file)
--- a/src/mod/endpoints/mod_portaudio/mod_portaudio.c
+++ b/src/mod/endpoints/mod_portaudio/mod_portaudio.c
@@ -331,7 +331,7 @@ static void add_pvt(private_t * tech_pvt, int master)
 
        switch_mutex_lock(globals.pvt_lock);
 
-       if (switch_strlen_zero(tech_pvt->call_id)) {
+       if (*tech_pvt->call_id == '\0') {
                switch_snprintf(tech_pvt->call_id, sizeof(tech_pvt->call_id), "%d", ++globals.call_id);
                switch_core_hash_insert(globals.call_hash, tech_pvt->call_id, tech_pvt);
                switch_core_session_set_read_codec(tech_pvt->session, &globals.read_codec);

diff --git a/src/mod/endpoints/mod_woomera/mod_woomera.c b/src/mod/endpoints/mod_woomera/mod_woomera.c
index 099f30589416a82d07924c7ac2d9c64f2f26665a..c0c89d4eacff85fbd298d0367d5522119612700f 100644 (file)
--- a/src/mod/endpoints/mod_woomera/mod_woomera.c
+++ b/src/mod/endpoints/mod_woomera/mod_woomera.c
@@ -98,8 +98,8 @@ struct woomera_message {
        int mval;
        char command[WOOMERA_STRLEN];
        char command_args[WOOMERA_STRLEN];
-       char names[WOOMERA_STRLEN][WOOMERA_ARRAY_LEN];
-       char values[WOOMERA_STRLEN][WOOMERA_ARRAY_LEN];
+       char names[WOOMERA_ARRAY_LEN][WOOMERA_STRLEN];
+       char values[WOOMERA_ARRAY_LEN][WOOMERA_STRLEN];
        char body[WOOMERA_BODYLEN];
        unsigned int flags;
        int last;

diff --git a/src/switch_core.c b/src/switch_core.c
index dbddd4bb0e2078d841e23ac5648d63ece15ffffb..838278990eff6ec4440c4762b585c1fbd949935b 100644 (file)
--- a/src/switch_core.c
+++ b/src/switch_core.c
@@ -589,7 +589,9 @@ SWITCH_DECLARE(switch_status_t) switch_core_mime_add_type(const char *type, cons
                if ((argc = switch_separate_string(ext_list, ' ', argv, (sizeof(argv) / sizeof(argv[0]))))) {
 
                        for (x = 0; x < argc; x++) {
-                               switch_core_hash_insert(runtime.mime_types, argv[x], ptype);
+                               if (argv[x] && ptype) {
+                                       switch_core_hash_insert(runtime.mime_types, argv[x], ptype);
+                               }
                        }
                        
                        status = SWITCH_STATUS_SUCCESS;

diff --git a/src/switch_ivr.c b/src/switch_ivr.c
index d44c8e3159da986edaf466dd5606fd871f398dbe..4c2e43588e7f0af98059f053c4cdf66a47e4e156 100644 (file)
--- a/src/switch_ivr.c
+++ b/src/switch_ivr.c
@@ -999,7 +999,7 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_digit_stream_parser_new(switch_memory
                        *parser = (switch_ivr_digit_stream_parser_t *) switch_core_alloc(pool, sizeof(switch_ivr_digit_stream_parser_t));
                }
                // if we have parser object, initialize it for the caller
-               if (*parser != NULL) {
+               if (pool && *parser != NULL) {
                        memset(*parser, 0, sizeof(switch_ivr_digit_stream_parser_t));
                        (*parser)->pool_auto_created = pool_auto_created;
                        (*parser)->pool = pool;

diff --git a/src/switch_utils.c b/src/switch_utils.c
index 947cbb8e239ede5324dbda302b7c2330669d30de..3bfbdc882cc8feee597adb8877391c834bfc9590 100644 (file)
--- a/src/switch_utils.c
+++ b/src/switch_utils.c
@@ -549,6 +549,10 @@ SWITCH_DECLARE(switch_status_t) switch_find_local_ip(char *buf, int len, int fam
        char abuf[25] = "";
 #endif
 
+       if (len < 16) {
+               return status;
+       }
+
        switch_copy_string(buf, "127.0.0.1", len);
 
        switch (family) {