From 8061ba32c35c4b4e53bb5176043d1addfb367f16 Mon Sep 17 00:00:00 2001
From: Russell Bryant <russell@russellbryant.com>
Date: Thu, 28 Jul 2005 17:40:46 +0000
Subject: [PATCH] fix potential seg fault when using LEN() with a string
 greater than 80 characters (bug #4839)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/v1-0@6240 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 pbx.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pbx.c b/pbx.c
index d788e1319c..d7e5f9985a 100755
--- a/pbx.c
+++ b/pbx.c
@@ -835,21 +835,22 @@ static void pbx_substitute_variables_temp(struct ast_channel *c, const char *var
 
 	if (c) 
 		headp=&c->varshead;
+	
 	*ret=NULL;
-	/* Now we have the variable name on cp3 */
+	
 	if (!strncasecmp(var,"LEN(",4)) {	/* ${LEN(<string>)} */
-		int len=strlen(var);
-		int len_len=4;
-		if (strrchr(var,')')) {
-			char cp3[80];
-			strncpy(cp3, var, sizeof(cp3) - 1);
-			cp3[len-len_len-1]='\0';
-			sprintf(workspace,"%d",(int)strlen(cp3));
-			*ret = workspace;
-		} else {
-			/* length is zero */
-			*ret = "0";
+		char *endparen, *string = ast_strdupa(var + 4);
+		int len = 0;
+		if (!string) {
+			ast_log(LOG_WARNING, "Out of memory!\n");
+			return;
 		}
+		if ((endparen = strrchr(string,')'))) {
+			*endparen = '\0';
+			len = strlen(string);
+		} 
+		sprintf(workspace, "%d", len);
+		*ret = workspace;
 	} else if ((first=strchr(var,':'))) {	/* : Remove characters counting from end or start of string */
 		strncpy(tmpvar, var, sizeof(tmpvar) - 1);
 		first = strchr(tmpvar, ':');
-- 
2.47.2