func_env: Prevent FILE() from reading garbage at end-of-file

If the last line of a file does not have a terminating EOL sequence, we
potentially add garbage to the value returned from the FILE() function.

There is no overflow potential here as we are reading from a buffer of a
known size, we are just reading too much of it.

ASTERISK-26481 #close

Change-Id: I50dd4fcf416fb3c83150040a1a79a59d9eb1ae01

diff --git a/funcs/func_env.c b/funcs/func_env.c
index 861adebae03b471e8dee6cdaaf2d0ae779791d0e..e6258531428656ac8da1fd4a9f17ad7017b5276c 100644 (file)
--- a/funcs/func_env.c
+++ b/funcs/func_env.c
@@ -709,12 +709,13 @@ static int file_read(struct ast_channel *chan, const char *cmd, char *data, stru
                ast_debug(3, "offset=%" PRId64 ", length=%" PRId64 ", offset_offset=%" PRId64 ", length_offset=%" PRId64 "\n", offset, length, offset_offset, length_offset);
                for (i = offset_offset; i < flength; i += sizeof(fbuf)) {
                        char *pos;
-                       if (fread(fbuf, 1, sizeof(fbuf), ff) < sizeof(fbuf) && !feof(ff)) {
+                       size_t bytes_read;
+                       if ((bytes_read = fread(fbuf, 1, sizeof(fbuf), ff)) < sizeof(fbuf) && !feof(ff)) {
                                ast_log(LOG_ERROR, "Short read?!!\n");
                                fclose(ff);
                                return -1;
                        }
-                       for (pos = fbuf; pos < fbuf + sizeof(fbuf); pos++) {
+                       for (pos = fbuf; pos < fbuf + bytes_read; pos++) {
                                LINE_COUNTER(pos, format, current_length);
 
                                if (current_length == length) {