From: Russell Bryant <russell@russellbryant.com>
Date: Tue, 20 Dec 2005 20:23:20 +0000 (+0000)
Subject: check array bounds when parsing arguments to AGI (issue #5868)
X-Git-Tag: 1.0.11.1~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=168ed954eb14b12e1a8527630394ada523494930;p=thirdparty%2Fasterisk.git

check array bounds when parsing arguments to AGI (issue #5868)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.0@7558 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/res/res_agi.c b/res/res_agi.c
index 830a11278d..8b2dc0c393 100644
--- a/res/res_agi.c
+++ b/res/res_agi.c
@@ -1649,9 +1649,8 @@ static int agi_exec_full(struct ast_channel *chan, void *data, int enhanced, int
 	strncpy(buf, data, sizeof(buf) - 1);
 
 	memset(&agi, 0, sizeof(agi));
-        while ((stringp = strsep(&tmp, "|"))) {
+        while ((stringp = strsep(&tmp, "|")) && argc < MAX_ARGS - 1)
 		argv[argc++] = stringp;
-        }
 	argv[argc] = NULL;
 
 	LOCAL_USER_ADD(u);