FS-10867: [freeswitch-core] Prevent stack smash when queing multiple sound files...

diff --git a/src/include/switch_core.h b/src/include/switch_core.h
index a07ea36a1ea69618084f1d9f2a2e86e566b9fd8d..d597c601a33b29c613d13a55a502409a2c17a2aa 100644 (file)
--- a/src/include/switch_core.h
+++ b/src/include/switch_core.h
@@ -1117,6 +1117,8 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_get_app_flags(const char *ap
 */
 #define switch_core_session_execute_application(_a, _b, _c) switch_core_session_execute_application_get_flags(_a, _b, _c, NULL)
 
+SWITCH_DECLARE(uint32_t) switch_core_session_stack_count(switch_core_session_t *session, int x);
+
 /*!
   \brief Run a dialplan and execute an extension
   \param session the current session

diff --git a/src/switch_core_session.c b/src/switch_core_session.c
index b57e239f92cb57127328a1f53e722b15792b5f57..dec61f3917fd421830be9d998d6ea9ca42fdf14f 100644 (file)
--- a/src/switch_core_session.c
+++ b/src/switch_core_session.c
@@ -2895,6 +2895,14 @@ SWITCH_DECLARE(switch_status_t) switch_core_session_exec(switch_core_session_t *
        return SWITCH_STATUS_SUCCESS;
 }
 
+SWITCH_DECLARE(uint32_t) switch_core_session_stack_count(switch_core_session_t *session, int x)
+{
+       if (x > 0) session->stack_count++;
+       else if (x < 0) session->stack_count--;
+
+       return session->stack_count;
+}
+
 SWITCH_DECLARE(switch_status_t) switch_core_session_execute_exten(switch_core_session_t *session, const char *exten, const char *dialplan,
                                                                                                                                  const char *context)
 {

diff --git a/src/switch_ivr.c b/src/switch_ivr.c
index 770c3bb81f60f461f504e5b4fa128847a7fff775..462ed56b22ceada0ba0d067a0700f0b01f2d8ad0 100644 (file)
--- a/src/switch_ivr.c
+++ b/src/switch_ivr.c
@@ -898,6 +898,14 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_parse_all_events(switch_core_session_
        int x = 0;
        switch_channel_t *channel;
 
+       if (switch_core_session_stack_count(session, 0) > SWITCH_MAX_STACKS) {
+               switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_ERROR, "Error %s too many stacked extensions\n",
+                                                 switch_core_session_get_name(session));
+               return SWITCH_STATUS_FALSE;
+       }
+
+       switch_core_session_stack_count(session, 1);
+       
        switch_ivr_parse_all_messages(session);
 
        channel = switch_core_session_get_channel(session);
@@ -914,6 +922,8 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_parse_all_events(switch_core_session_
                x++;
        }
 
+       switch_core_session_stack_count(session, -1);
+       
        return SWITCH_STATUS_SUCCESS;
 }