From: Sean Bright <sean.bright@gmail.com>
Date: Sun, 28 Nov 2021 20:52:24 +0000 (-0500)
Subject: config.c: Prevent UB in ast_realtime_require_field.
X-Git-Tag: 16.23.0-rc1~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1dce155f07a59f11618800e082d99c9ef190825d;p=thirdparty%2Fasterisk.git

config.c: Prevent UB in ast_realtime_require_field.

A backend's implementation of the realtime 'require' function may call
va_arg() and then fail, leaving the va_list in an undefined
state. Pass a copy of the va_list instead.

ASTERISK-29771 #close

Change-Id: I555565a72af84e96d49f62fe8cb66ba5a78461f4
---

diff --git a/main/config.c b/main/config.c
index 46f05aaf16..c5e42fa8a9 100644
--- a/main/config.c
+++ b/main/config.c
@@ -3384,16 +3384,19 @@ int ast_realtime_require_field(const char *family, ...)
 	struct ast_config_engine *eng;
 	char db[256];
 	char table[256];
-	va_list ap;
+	va_list ap, aq;
 	int res = -1, i;
 
 	va_start(ap, family);
 	for (i = 1; ; i++) {
 		if ((eng = find_engine(family, i, db, sizeof(db), table, sizeof(table)))) {
+			va_copy(aq, ap);
 			/* If the require succeeds, it returns 0. */
-			if (eng->require_func && !(res = eng->require_func(db, table, ap))) {
+			if (eng->require_func && !(res = eng->require_func(db, table, aq))) {
+				va_end(aq);
 				break;
 			}
+			va_end(aq);
 		} else {
 			break;
 		}