fix bounds checking (bug #4406)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/v1-0@5911 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index f255cdd4c76f23122d372b0b69f373a8045ab1f7..9e897bc58121dc18be3d5c956f408f4f7b43bbf3 100755 (executable)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -2234,8 +2234,10 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
                        }
             if ((p->dtmfmode & SIP_DTMF_INBAND) && p->vad) {
                    f = ast_dsp_process(p->owner,p->vad,f);
-                  if (f && (f->frametype == AST_FRAME_DTMF)) 
+                  if (f && (f->frametype == AST_FRAME_DTMF)) {
                        ast_log(LOG_DEBUG, "Detected DTMF '%c'\n", f->subclass);
+                       ast_log(LOG_NOTICE, "Detected inband DTMF '%c'\n", f->subclass);
+                  }
             }
                }
        }
@@ -2821,54 +2823,52 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req)
 /*--- add_header: Add header to SIP message */
 static int add_header(struct sip_request *req, char *var, char *value)
 {
-       if (req->len >= sizeof(req->data) - 4) {
-               ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+       if (req->headers == SIP_MAX_HEADERS) {
+               ast_log(LOG_WARNING, "Out of SIP header space\n");
                return -1;
        }
        if (req->lines) {
                ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
                return -1;
        }
+       if (req->len >= sizeof(req->data) - 4) {
+               ast_log(LOG_WARNING, "Out of space, can't add anymore (%s:%s)\n", var, value);
+               return -1;
+       }
        req->header[req->headers] = req->data + req->len;
        snprintf(req->header[req->headers], sizeof(req->data) - req->len - 4, "%s: %s\r\n", var, value);
        req->len += strlen(req->header[req->headers]);
-       if (req->headers < SIP_MAX_HEADERS)
-               req->headers++;
-       else {
-               ast_log(LOG_WARNING, "Out of header space\n");
-               return -1;
-       }
+       req->headers++;
        return 0;       
 }
 
 /*--- add_blank_header: Add blank header to SIP message */
 static int add_blank_header(struct sip_request *req)
 {
-       if (req->len >= sizeof(req->data) - 4) {
-               ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+       if (req->headers == SIP_MAX_HEADERS)  {
+               ast_log(LOG_WARNING, "Out of SIP header space\n");
                return -1;
        }
        if (req->lines) {
                ast_log(LOG_WARNING, "Can't add more headers when lines have been added\n");
                return -1;
        }
+       if (req->len >= sizeof(req->data) - 4) {
+               ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+               return -1;
+       }
        req->header[req->headers] = req->data + req->len;
        snprintf(req->header[req->headers], sizeof(req->data) - req->len, "\r\n");
        req->len += strlen(req->header[req->headers]);
-       if (req->headers < SIP_MAX_HEADERS)
-               req->headers++;
-       else {
-               ast_log(LOG_WARNING, "Out of header space\n");
-               return -1;
-       }
+       req->headers++;
        return 0;       
 }
 
 /*--- add_line: Add content (not header) to SIP message */
 static int add_line(struct sip_request *req, char *line)
 {
-       if (req->len >= sizeof(req->data) - 4) {
-               ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+       if (req->lines == SIP_MAX_LINES) {
+               ast_log(LOG_WARNING, "Out of line space\n");
                return -1;
        }
        if (!req->lines) {
@@ -2876,15 +2876,14 @@ static int add_line(struct sip_request *req, char *line)
                snprintf(req->data + req->len, sizeof(req->data) - req->len, "\r\n");
                req->len += strlen(req->data + req->len);
        }
+       if (req->len >= sizeof(req->data) - 4) {
+               ast_log(LOG_WARNING, "Out of space, can't add anymore\n");
+               return -1;
+       }
        req->line[req->lines] = req->data + req->len;
        snprintf(req->line[req->lines], sizeof(req->data) - req->len, "%s", line);
        req->len += strlen(req->line[req->lines]);
-       if (req->lines < SIP_MAX_LINES)
-               req->lines++;
-       else {
-               ast_log(LOG_WARNING, "Out of line space\n");
-               return -1;
-       }
+       req->lines++;
        return 0;       
 }
 
@@ -3060,10 +3059,7 @@ static int init_resp(struct sip_request *req, char *resp, struct sip_request *or
        req->header[req->headers] = req->data + req->len;
        snprintf(req->header[req->headers], sizeof(req->data) - req->len, "SIP/2.0 %s\r\n", resp);
        req->len += strlen(req->header[req->headers]);
-       if (req->headers < SIP_MAX_HEADERS)
-               req->headers++;
-       else
-               ast_log(LOG_WARNING, "Out of header space\n");
+       req->headers++;
        return 0;
 }
 
@@ -3078,10 +3074,7 @@ static int init_req(struct sip_request *req, char *resp, char *recip)
        req->header[req->headers] = req->data + req->len;
        snprintf(req->header[req->headers], sizeof(req->data) - req->len, "%s %s SIP/2.0\r\n", resp, recip);
        req->len += strlen(req->header[req->headers]);
-       if (req->headers < SIP_MAX_HEADERS)
-               req->headers++;
-       else
-               ast_log(LOG_WARNING, "Out of header space\n");
+       req->headers++;
        return 0;
 }