bounds checks and scope masked var names.

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@6844 d0543943-73ff-0310-b7d9-9358b9ac24b2

diff --git a/src/switch_channel.c b/src/switch_channel.c
index 5b4a439b30466cce172699917249ca3e53be6d20..7119d0b17460041815305c1889ff08b659304fe6 100644 (file)
--- a/src/switch_channel.c
+++ b/src/switch_channel.c
@@ -635,9 +635,11 @@ SWITCH_DECLARE(switch_channel_state_t) switch_channel_perform_set_state(switch_c
 
 
        switch_assert(channel != NULL);
+       switch_assert(state <= CS_DONE);
        switch_mutex_lock(channel->flag_mutex);
 
        last_state = channel->state;
+       switch_assert(last_state <= CS_DONE);
 
        if (last_state == state) {
                goto done;
@@ -1498,19 +1500,19 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
                                        char *expanded = NULL;
                                        int offset = 0;
                                        int ooffset = 0;
-                                       char *p;
+                                       char *ptr;
 
                                        if ((expanded = switch_channel_expand_variables(channel, (char *)vname)) == vname) {
                                                expanded = NULL;
                                        } else {
                                                vname = expanded;
                                        }
-                                       if ((p = strchr(vname, ':'))) {
-                                               *p++ = '\0';
-                                               offset = atoi(p);
-                                               if ((p = strchr(p, ':'))) {
-                                                       p++;
-                                                       ooffset = atoi(p);
+                                       if ((ptr = strchr(vname, ':'))) {
+                                               *ptr++ = '\0';
+                                               offset = atoi(ptr);
+                                               if ((ptr = strchr(ptr, ':'))) {
+                                                       ptr++;
+                                                       ooffset = atoi(ptr);
                                                }
                                        }
                                        
@@ -1528,8 +1530,8 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
                                        }
 
                                        if (ooffset > 0 && (size_t)ooffset < strlen(sub_val)) {
-                                               if ((p = (char *)sub_val + ooffset)) {
-                                                       *p = '\0';
+                                               if ((ptr = (char *)sub_val + ooffset)) {
+                                                       *ptr = '\0';
                                                }
                                        }
 

diff --git a/src/switch_core_media_bug.c b/src/switch_core_media_bug.c
index ff443ffce45781efe14c15af7e1abc59c1510672..facb92879e3847fd7faf89e4efd8894cc2f68570 100644 (file)
--- a/src/switch_core_media_bug.c
+++ b/src/switch_core_media_bug.c
@@ -128,9 +128,10 @@ SWITCH_DECLARE(switch_status_t) switch_core_media_bug_read(switch_media_bug_t *b
 
 
        bytes = (datalen > frame->datalen) ? datalen : frame->datalen;
+       switch_assert( bytes <= maxlen );
        
        if (bytes) {
-               int16_t tmp[960], *tp = tmp;
+               int16_t tmp[SWITCH_RECOMMENDED_BUFFER_SIZE], *tp = tmp;
                
                dp = (int16_t *) data;
                fp = (int16_t *) frame->data;

diff --git a/src/switch_ivr_originate.c b/src/switch_ivr_originate.c
index d1076402ce67173011a68b7a1da3051e00f2131d..42f0f21b5ebef59620dabc81daf02bedf04aeb2a 100644 (file)
--- a/src/switch_ivr_originate.c
+++ b/src/switch_ivr_originate.c
@@ -277,6 +277,13 @@ SWITCH_DECLARE(switch_status_t) switch_ivr_originate(switch_core_session_t *sess
 
        *bleg = NULL;
        odata = strdup(bridgeto);
+
+       if (!odata) {
+               switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Memory Error!\n");
+               status = SWITCH_STATUS_MEMERR;
+               goto done;
+       }
+
        data = odata;
 
        /* strip leading spaces */