From: Stefan Knoblich <s.knoblich@axsentis.de>
Date: Thu, 11 Nov 2010 22:53:19 +0000 (+0100)
Subject: mod_freetdm: Avoid overflowing the spanparameters array of libpri spans, and make... 
X-Git-Tag: v1.2-rc1~265^2~11^2~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eeaab3a02e507f273bf140845a1962b4c757895d;p=thirdparty%2Ffreeswitch.git

mod_freetdm: Avoid overflowing the spanparameters array of libpri spans, and make other span types use ftdm_array_len() too.

Signed-off-by: Stefan Knoblich <s.knoblich@axsentis.de>
---

diff --git a/libs/freetdm/mod_freetdm/mod_freetdm.c b/libs/freetdm/mod_freetdm/mod_freetdm.c
index 0a35913ec4..879dd05155 100755
--- a/libs/freetdm/mod_freetdm/mod_freetdm.c
+++ b/libs/freetdm/mod_freetdm/mod_freetdm.c
@@ -2594,7 +2594,7 @@ static switch_status_t load_config(void)
 				char *var = (char *) switch_xml_attr_soft(param, "name");
 				char *val = (char *) switch_xml_attr_soft(param, "value");
 
-				if (sizeof(spanparameters)/sizeof(spanparameters[0]) == paramindex) {
+				if (ftdm_array_len(spanparameters) == paramindex) {
 					switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Too many parameters for ss7 span, ignoring any parameter after %s\n", var);
 					break;
 				}
@@ -3106,6 +3106,11 @@ static switch_status_t load_config(void)
 				char *var = (char *) switch_xml_attr_soft(param, "name");
 				char *val = (char *) switch_xml_attr_soft(param, "value");
 
+				if (ftdm_array_len(spanparameters) == paramindex) {
+					ftdm_log(FTDM_LOG_ERROR, "Too many parameters for libpri span, ignoring everything after '%s'\n", var);
+					break;
+				}
+
 				if (!strcasecmp(var, "context")) {
 					context = val;
 				} else if (!strcasecmp(var, "dialplan")) {
@@ -3165,7 +3170,8 @@ static switch_status_t load_config(void)
 			for (param = switch_xml_child(myspan, "param"); param; param = param->next) {
 				char *var = (char *) switch_xml_attr_soft(param, "name");
 				char *val = (char *) switch_xml_attr_soft(param, "value");
-				if (sizeof(spanparameters)/sizeof(spanparameters[0]) == paramindex) {
+
+				if (ftdm_array_len(spanparameters) == paramindex) {
 					switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Too many parameters for boost span, ignoring any parameter after %s\n", var);
 					break;
 				}