config: bug: Fix SEGV in ast_category_insert when matching category isn't found

If you call ast_category_insert with a match category that doesn't exist, the
list traverse runs out of 'next' categories and you get a SEGV.  This patch
adds check for the end-of-list condition and changes the signature to return
an int for success/failure indication instead of a void.

The only consumer of this function is manager and it was also changed to use
the return value.

Tested by: George Joseph
Review: https://reviewboard.asterisk.org/r/3993/
........

Merged revisions 423276 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@423277 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/config.h b/include/asterisk/config.h
index dae4b5277aa86403c9a0334c49cdde8f2742c8cd..711a4f4c4fca48159c379915a723b23e5b3e29a3 100644 (file)
--- a/include/asterisk/config.h
+++ b/include/asterisk/config.h
@@ -576,8 +576,11 @@ void ast_category_append(struct ast_config *config, struct ast_category *cat);
  * \details
  * This function is used to insert a new category above another category
  * matching the match parameter.
+ *
+ * \retval 0 if succeeded
+ * \retval -1 if NULL parameters or match category was not found
  */
-void ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match);
+int ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match);
 int ast_category_delete(struct ast_config *cfg, const char *category);
 
 /*!

diff --git a/main/config.c b/main/config.c
index 5f37945d95eef0c5c2958f3e0579b314c352c7f9..451d17b8153d26be2e74260befe02fbf5cb90cb4 100644 (file)
--- a/main/config.c
+++ b/main/config.c
@@ -729,24 +729,28 @@ void ast_category_append(struct ast_config *config, struct ast_category *categor
        config->current = category;
 }
 
-void ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match)
+int ast_category_insert(struct ast_config *config, struct ast_category *cat, const char *match)
 {
        struct ast_category *cur_category;
 
-       if (!cat || !match)
-               return;
+       if (!config || !cat || !match) {
+               return -1;
+       }
        if (!strcasecmp(config->root->name, match)) {
                cat->next = config->root;
                config->root = cat;
-               return;
+               return 0;
        }
-       for (cur_category = config->root; cur_category; cur_category = cur_category->next) {
+       for (cur_category = config->root; cur_category && cur_category->next;
+               cur_category = cur_category->next) {
                if (!strcasecmp(cur_category->next->name, match)) {
                        cat->next = cur_category->next;
                        cur_category->next = cat;
-                       break;
+                       return 0;
                }
        }
+
+       return -1;
 }
 
 static void ast_destroy_template_list(struct ast_category *cat)

diff --git a/main/manager.c b/main/manager.c
index 5f976afdccdf7cc143ea421d5eae615133f25f08..acaff116f1edb8496a78304c427298951c9c90f2 100644 (file)
--- a/main/manager.c
+++ b/main/manager.c
@@ -2933,7 +2933,11 @@ static enum error_type handle_updates(struct mansession *s, const struct message
                        if (ast_strlen_zero(match)) {
                                ast_category_append(cfg, category);
                        } else {
-                               ast_category_insert(cfg, category, match);
+                               if (ast_category_insert(cfg, category, match)) {
+                                       result = FAILURE_NEWCAT;
+                                       ast_category_destroy(category);
+                                       break;
+                               }
                        }
                } else if (!strcasecmp(action, "renamecat")) {
                        if (ast_strlen_zero(value)) {