From: Richard Mudgett <rmudgett@digium.com>
Date: Wed, 8 Jun 2011 20:46:55 +0000 (+0000)
Subject: Ring all queue with more than 255 agents will cause crash.
X-Git-Tag: 1.8.5-rc1~11^2~48
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e0b2c103f6eafd8a6513de81fb6152698856ee49;p=thirdparty%2Fasterisk.git

Ring all queue with more than 255 agents will cause crash.

1. Create a ring-all queue with 500 permanent agents.
2. Call it.
3. Asterisk will crash.

The watchers array in app_queue.c has a hard limit of 255.  Bounds
checking is not done on this array.  No sane person should put 255 people
in a ring-all queue, but we should not crash anyway.

* Added bounds checking to the watchers array.

JIRA AST-464
JIRA SWP-2903


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@322484 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/apps/app_queue.c b/apps/app_queue.c
index dc7a0a074a..dfc1a0b250 100644
--- a/apps/app_queue.c
+++ b/apps/app_queue.c
@@ -3486,7 +3486,9 @@ static struct callattempt *wait_for_answer(struct queue_ent *qe, struct callatte
 				if (o->stillgoing) {	/* Keep track of important channels */
 					stillgoing = 1;
 					if (o->chan) {
-						watchers[pos++] = o->chan;
+						if (pos < AST_MAX_WATCHERS) {
+							watchers[pos++] = o->chan;
+						}
 						if (!start)
 							start = o;
 						else