From: Richard Mudgett <rmudgett@digium.com>
Date: Mon, 23 Jun 2014 15:53:09 +0000 (+0000)
Subject: core_unreal: Fix off by one buffer overwrite error.
X-Git-Tag: 12.4.0-rc1~29
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b970cb28a0fd8a37ec219a11c14a121d31965239;p=thirdparty%2Fasterisk.git

core_unreal: Fix off by one buffer overwrite error.

Appending the ;2 to the user supplied ;1 uniqueid to create the ;2 version
if the user did not also supply an extra uniqueid for the ;2 channel
resulted in allocating a buffer that was one byte too small.

* Fix off by one error in ast_unreal_new_channels() when generating the ;2
uniqueid from the user suppled ;1 version.

* Pulled some long assignment lines from if tests to improve line break
readability in ast_unreal_new_channels().


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@417119 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/core_unreal.c b/main/core_unreal.c
index 481ed2d0cc..c9afa5194e 100644
--- a/main/core_unreal.c
+++ b/main/core_unreal.c
@@ -911,7 +911,7 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
 	if (id1.uniqueid && ast_strlen_zero(id2.uniqueid)) {
 		char *uniqueid2;
 
-		uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 2);
+		uniqueid2 = ast_alloca(strlen(id1.uniqueid) + 3);
 		strcpy(uniqueid2, id1.uniqueid);/* Safe */
 		strcat(uniqueid2, ";2");/* Safe */
 		id2.uniqueid = uniqueid2;
@@ -924,9 +924,10 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
 	 * You can't pass linkedid to both allocations since if linkedid
 	 * isn't set, then each channel will generate its own linkedid.
 	 */
-	if (!(owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
-			exten, context, &id1, requestor, 0,
-			"%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno))) {
+	owner = ast_channel_alloc(1, semi1_state, NULL, NULL, NULL,
+		exten, context, &id1, requestor, 0,
+		"%s/%s-%08x;1", tech->type, p->name, (unsigned)generated_seqno);
+	if (!owner) {
 		ast_log(LOG_WARNING, "Unable to allocate owner channel structure\n");
 		return NULL;
 	}
@@ -964,9 +965,10 @@ struct ast_channel *ast_unreal_new_channels(struct ast_unreal_pvt *p,
 	p->owner = owner;
 	ast_channel_unlock(owner);
 
-	if (!(chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
-			exten, context, &id2, owner, 0,
-			"%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno))) {
+	chan = ast_channel_alloc(1, semi2_state, NULL, NULL, NULL,
+		exten, context, &id2, owner, 0,
+		"%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno);
+	if (!chan) {
 		ast_log(LOG_WARNING, "Unable to allocate chan channel structure\n");
 		ao2_ref(p, -1);
 		ast_channel_tech_pvt_set(owner, NULL);