Ring all queue with more than 255 agents will cause crash.

1. Create a ring-all queue with 500 permanent agents.
2. Call it.
3. Asterisk will crash.

The watchers array in app_queue.c has a hard limit of 255.  Bounds
checking is not done on this array.  No sane person should put 255 people
in a ring-all queue, but we should not crash anyway.

* Added bounds checking to the watchers array.

JIRA AST-464
JIRA SWP-2903

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@322484 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/apps/app_queue.c b/apps/app_queue.c
index dc7a0a074a1ad7bd37d7fa27089998ae0c454adb..dfc1a0b2501f9437d1be680c2b20fdb6e8dbce2e 100644 (file)
--- a/apps/app_queue.c
+++ b/apps/app_queue.c
@@ -3486,7 +3486,9 @@ static struct callattempt *wait_for_answer(struct queue_ent *qe, struct callatte
                                if (o->stillgoing) {    /* Keep track of important channels */
                                        stillgoing = 1;
                                        if (o->chan) {
-                                               watchers[pos++] = o->chan;
+                                               if (pos < AST_MAX_WATCHERS) {
+                                                       watchers[pos++] = o->chan;
+                                               }
                                                if (!start)
                                                        start = o;
                                                else