Fix checking bounds of array index after using it; improper sizeof

This patch fixes two problems pointed out by a static analysis tool.

* In chan_dahdi, when an event is handled the index of the sub channel is first
  obtained.  In very off nominal cases, the method that determines the index
  can return a negative value.  In the event handling code, whether or not
  the index returned is valid was being checked after that value was used to
  index into an array.  This patch makes it so the value is checked before
  any indexing is done.

* In res_calendar_ews, sizeof was being passed a pointer instead of the struct to
  determine the amount of memory to allocate.

(issue ASTERISK-19651)
Reported by: Matt Jordan

(closes issue ASTERISK-19671)
Reported by: Matt Jordan

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@366740 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 51f9c2d7fb9f4de39a9cb02560b2a7af0d0d24bc..7d41dd1e67fcb4aec21a242f425778a6a2c4fb08 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -7871,6 +7871,9 @@ static struct ast_frame *dahdi_handle_event(struct ast_channel *ast)
        struct ast_frame *f;
 
        idx = dahdi_get_index(ast, p, 0);
+       if (idx < 0) {
+               return &ast_null_frame;
+       }
        mysig = p->sig;
        if (p->outsigmod > -1)
                mysig = p->outsigmod;
@@ -7884,8 +7887,6 @@ static struct ast_frame *dahdi_handle_event(struct ast_channel *ast)
        p->subs[idx].f.data.ptr = NULL;
        f = &p->subs[idx].f;
 
-       if (idx < 0)
-               return &p->subs[idx].f;
        if (p->fake_event) {
                res = p->fake_event;
                p->fake_event = 0;

diff --git a/res/res_calendar_ews.c b/res/res_calendar_ews.c
index d33f4be4fb1c41de67f57b839584c988bf2f9af1..7deca9c97553de5ef31299f19b7606f08b56cbdc 100644 (file)
--- a/res/res_calendar_ews.c
+++ b/res/res_calendar_ews.c
@@ -233,7 +233,7 @@ static int startelm(void *userdata, int parent, const char *nspace, const char *
                /* Event UID */
                if (ctx->op == XML_OP_FIND) {
                        struct calendar_id *id;
-                       if (!(id = ast_calloc(1, sizeof(id)))) {
+                       if (!(id = ast_calloc(1, sizeof(*id)))) {
                                return NE_XML_ABORT;
                        }
                        if (!(id->id = ast_str_create(256))) {