From: Sean Bright <sean@malleable.com>
Date: Fri, 1 May 2009 16:26:32 +0000 (+0000)
Subject: Fix a crash in app_queue with very long member lists.
X-Git-Tag: 1.6.1.3-rc1~288
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e05a147fe1e7b64c560c2dbf9fd2853bb1d80012;p=thirdparty%2Fasterisk.git

Fix a crash in app_queue with very long member lists.

A user reported via #asterisk that with very long lists of members, a crash
occurs in ast_strdupa, so just use a single buffer and ast_copy_string instead
of stack allocating copys of each interface name.

(Related to revision 191041 in branches/1.4)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@191454 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/apps/app_queue.c b/apps/app_queue.c
index cc5eba4683..5876a9950a 100644
--- a/apps/app_queue.c
+++ b/apps/app_queue.c
@@ -716,15 +716,15 @@ static int update_status(const char *interface, const int status)
 	struct member *cur;
 	struct ao2_iterator mem_iter, queue_iter;
 	struct call_queue *q;
+	char tmp_interface[80];
 
 	queue_iter = ao2_iterator_init(queues, 0);
 	while ((q = ao2_iterator_next(&queue_iter))) {
 		ao2_lock(q);
 		mem_iter = ao2_iterator_init(q->members, 0);
 		while ((cur = ao2_iterator_next(&mem_iter))) {
-			char *tmp_interface;
 			char *slash_pos;
-			tmp_interface = ast_strdupa(cur->state_interface);
+			ast_copy_string(tmp_interface, cur->state_interface, sizeof(tmp_interface));
 			if ((slash_pos = strchr(tmp_interface, '/')))
 				if (!strncasecmp(tmp_interface, "Local", 5) && (slash_pos = strchr(slash_pos + 1, '/')))
 					*slash_pos = '\0';
@@ -768,12 +768,12 @@ static int handle_statechange(void *datap)
 {
 	struct member_interface *curint;
 	struct statechange *sc = datap;
+	char interface[80];
 
 	AST_LIST_LOCK(&interfaces);
 	AST_LIST_TRAVERSE(&interfaces, curint, list) {
-		char *interface;
 		char *slash_pos;
-		interface = ast_strdupa(curint->interface);
+		ast_copy_string(interface, curint->interface, sizeof(interface));
 		if ((slash_pos = strchr(interface, '/')))
 			if ((slash_pos = strchr(slash_pos + 1, '/')))
 				*slash_pos = '\0';