Safely use the strncat() function.

(closes issue #11958)
 Reported by: norman
 Patches:
       20080209__bug11958.diff.txt uploaded by Corydon76 (license 14)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@106552 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/apps/app_chanspy.c b/apps/app_chanspy.c
index a1e54ca4400cd2488d3ab789e19e3060648b2b01..eb093e09fcafe5489c40dd7bbdc1195288212c2d 100644 (file)
--- a/apps/app_chanspy.c
+++ b/apps/app_chanspy.c
@@ -579,7 +579,7 @@ static int common_exec(struct ast_channel *chan, const struct ast_flags *flags,
                        }
 
                        strcpy(peer_name, "spy-");
-                       strncat(peer_name, peer->name, AST_NAME_STRLEN);
+                       strncat(peer_name, peer->name, AST_NAME_STRLEN - 4 - 1);
                        ptr = strchr(peer_name, '/');
                        *ptr++ = '\0';
                        

diff --git a/apps/app_rpt.c b/apps/app_rpt.c
index e7f7b003c8a0525e9c3e843d0b5a8929f9dd3325..292dfc6f69edf6c6c2cf5d68fc27cbd53af56289 100644 (file)
--- a/apps/app_rpt.c
+++ b/apps/app_rpt.c
@@ -2427,7 +2427,7 @@ static int rpt_do_fun(int fd, int argc, char *argv[])
                        }
                        if(!busy){
                                myrpt->macrotimer = MACROTIME;
-                               strncat(myrpt->macrobuf,argv[3],MAXMACRO - 1);
+                               strncat(myrpt->macrobuf, argv[3], MAXMACRO - strlen(myrpt->macrobuf) - 1);
                        }
                        rpt_mutex_unlock(&myrpt->lock);
                }
@@ -5090,7 +5090,7 @@ int       i;
                return DC_ERROR;
        }
        myrpt->macrotimer = MACROTIME;
-       strncat(myrpt->macrobuf,val,MAXMACRO - 1);
+       strncat(myrpt->macrobuf, val, MAXMACRO - strlen(myrpt->macrobuf) - 1);
        rpt_mutex_unlock(&myrpt->lock);
        return DC_COMPLETE;     
 }
@@ -8749,7 +8749,7 @@ static void do_scheduler(struct rpt *myrpt)
                                return; /* Macro buffer full */
                        }
                        myrpt->macrotimer = MACROTIME;
-                       strncat(myrpt->macrobuf,val,MAXMACRO - 1);
+                       strncat(myrpt->macrobuf,val,MAXMACRO - strlen(myrpt->macrobuf) - 1);
                }
                else{
                        ast_log(LOG_WARNING,"Malformed scheduler entry in rpt.conf: %s = %s\n",

diff --git a/apps/app_speech_utils.c b/apps/app_speech_utils.c
index e45459166c6e5ac80e0f0a157cbeeaa43e79246a..64d0f1bc48df4aa5b3e3903943c1eddc2080bbbe 100644 (file)
--- a/apps/app_speech_utils.c
+++ b/apps/app_speech_utils.c
@@ -735,7 +735,7 @@ static int speech_background(struct ast_channel *chan, void *data)
                                        }
                                        time(&start);
                                        snprintf(tmp, sizeof(tmp), "%c", f->subclass);
-                                       strncat(dtmf, tmp, sizeof(dtmf));
+                                       strncat(dtmf, tmp, sizeof(dtmf) - strlen(dtmf) - 1);
                                        /* If the maximum length of the DTMF has been reached, stop now */
                                        if (max_dtmf_len && strlen(dtmf) == max_dtmf_len)
                                                done = 1;

diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c
index 74bfd2c9a3c2e2b74522fcd3c986f38f27787231..79e8bf2ea4d9d07a721ad268eead8b2c2d47447c 100644 (file)
--- a/apps/app_voicemail.c
+++ b/apps/app_voicemail.c
@@ -3842,8 +3842,8 @@ static int vm_forwardoptions(struct ast_channel *chan, struct ast_vm_user *vmu,
        make_file(msgfile, sizeof(msgfile), curdir, curmsg);
        strcpy(textfile, msgfile);
        strcpy(backup, msgfile);
-       strncat(textfile, ".txt", sizeof(textfile) - 1);
-       strncat(backup, "-bak", sizeof(backup) - 1);
+       strncat(textfile, ".txt", sizeof(textfile) - strlen(textfile) - 1);
+       strncat(backup, "-bak", sizeof(backup) - strlen(backup) - 1);
 
        if (!(msg_cfg = ast_config_load(textfile))) {
                return -1;

diff --git a/channels/chan_misdn.c b/channels/chan_misdn.c
index 47505dfddf5322b3e08290e66664d792c67e8c31..c70c45938f04f4a252a82b56f47a7f32968b6b61 100644 (file)
--- a/channels/chan_misdn.c
+++ b/channels/chan_misdn.c
@@ -2246,8 +2246,7 @@ static int misdn_digit_end(struct ast_channel *ast, char digit, unsigned int dur
                        buf[1]=0;
                        
                        l = sizeof(bc->infos_pending);
-                       strncat(bc->infos_pending,buf,l);
-                       bc->infos_pending[l-1] = 0;
+                       strncat(bc->infos_pending, buf, l - strlen(bc->infos_pending) - 1);
                }
                break;
                case MISDN_CALLING_ACKNOWLEDGE:
@@ -2257,8 +2256,7 @@ static int misdn_digit_end(struct ast_channel *ast, char digit, unsigned int dur
                        
                        {
                                int l = sizeof(bc->dad);
-                               strncat(bc->dad,bc->info_dad, l - strlen(bc->dad));
-                               bc->dad[l-1] = 0;
+                               strncat(bc->dad, bc->info_dad, l - strlen(bc->dad) - 1);
                        }
                        {
                                int l = sizeof(p->ast->exten);
@@ -4054,8 +4052,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data)
                        }
 
                        l = sizeof(bc->dad);
-                       strncat(bc->dad,bc->info_dad, l);
-                       bc->dad[l-1] = 0;
+                       strncat(bc->dad,bc->info_dad, l - strlen(bc->dad) - 1);
 
                        l = sizeof(ch->ast->exten);
                        strncpy(ch->ast->exten, bc->dad, l);
@@ -4133,8 +4130,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data)
                        if (ch->state != MISDN_CONNECTED ) {
                                if (digits) {
                                        int l = sizeof(bc->dad);
-                                       strncat(bc->dad,bc->info_dad, l);
-                                       bc->dad[l-1] = 0;
+                                       strncat(bc->dad, bc->info_dad, l - strlen(bc->dad) - 1);
                                        l = sizeof(ch->ast->exten);
                                        strncpy(ch->ast->exten, bc->dad, l);
                                        ch->ast->exten[l-1] = 0;
@@ -4436,8 +4432,7 @@ cb_events(enum event_e event, struct misdn_bchannel *bc, void *user_data)
                        
                        {
                                int l = sizeof(bc->dad);
-                               strncat(bc->dad,bc->infos_pending, l - strlen(bc->dad));
-                               bc->dad[l-1] = 0;
+                               strncat(bc->dad, bc->infos_pending, l - strlen(bc->dad) - 1);
                        }       
                
                        if (!ch->ast) break;

diff --git a/funcs/func_enum.c b/funcs/func_enum.c
index 43e953c3b6a423947874d92a5ea32bb1c3f02824..55493790896427fcd784d20fcbf97fb9eb27959e 100644 (file)
--- a/funcs/func_enum.c
+++ b/funcs/func_enum.c
@@ -98,7 +98,7 @@ static int function_enum(struct ast_channel *chan, char *cmd, char *data,
        for (s = p = args.number; *s; s++) {
                if (*s != '-') {
                        snprintf(tmp, sizeof(tmp), "%c", *s);
-                       strncat(num, tmp, sizeof(num));
+                       strncat(num, tmp, sizeof(num) - strlen(num) - 1);
                }
 
        }

diff --git a/main/asterisk.c b/main/asterisk.c
index 51423bf553dafdbdec1ee490659f6406fa92eed1..77d1489ffd356c6e8848fde34e91c6e2ec185ff0 100644 (file)
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -1932,9 +1932,10 @@ static char *cli_prompt(EditLine *el)
                if (color_used) {
                        /* Force colors back to normal at end */
                        term_color_code(term_code, COLOR_WHITE, COLOR_BLACK, sizeof(term_code));
-                       if (strlen(term_code) > sizeof(prompt) - strlen(prompt)) {
-                               strncat(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code));
+                       if (strlen(term_code) > sizeof(prompt) - strlen(prompt) - 1) {
+                               ast_copy_string(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code) + 1);
                        } else {
+                               /* This looks wrong, but we've already checked the length of term_code to ensure it's safe */
                                strncat(p, term_code, sizeof(term_code));
                        }
                }

diff --git a/main/channel.c b/main/channel.c
index 73c7db60385227ce96f3d790db9638290df2ee41..febebc5152f5d34174281b94916e8f31805ecf2d 100644 (file)
--- a/main/channel.c
+++ b/main/channel.c
@@ -4373,12 +4373,12 @@ char *ast_print_group(char *buf, int buflen, ast_group_t group)
        for (i = 0; i <= 63; i++) {     /* Max group is 63 */
                if (group & ((ast_group_t) 1 << i)) {
                        if (!first) {
-                               strncat(buf, ", ", buflen);
+                               strncat(buf, ", ", buflen - strlen(buf) - 1);
                        } else {
                                first=0;
                        }
                        snprintf(num, sizeof(num), "%u", i);
-                       strncat(buf, num, buflen);
+                       strncat(buf, num, buflen - strlen(buf) - 1);
                }
        }
        return buf;

diff --git a/main/frame.c b/main/frame.c
index 1dafce9f8497466d2b536966a27f8338672ab50d..fa54e6772be745f91ecebcdcbfbc09fbf14cedba 100644 (file)
--- a/main/frame.c
+++ b/main/frame.c
@@ -1091,16 +1091,16 @@ int ast_codec_pref_string(struct ast_codec_pref *pref, char *buf, size_t size)
                        slen = strlen(formatname);
                        if(slen > total_len)
                                break;
-                       strncat(buf,formatname,total_len);
+                       strncat(buf, formatname, total_len - 1); /* safe */
                        total_len -= slen;
                }
                if(total_len && x < 31 && ast_codec_pref_index(pref , x + 1)) {
-                       strncat(buf,"|",total_len);
+                       strncat(buf, "|", total_len - 1); /* safe */
                        total_len--;
                }
        }
        if(total_len) {
-               strncat(buf,")",total_len);
+               strncat(buf, ")", total_len - 1); /* safe */
                total_len--;
        }
 

diff --git a/main/manager.c b/main/manager.c
index b78ecf5e3539b1a2ab620a72175a67f21f4b4def..4fadb744ca6c8d548b00894efc886a683a510cfd 100644 (file)
--- a/main/manager.c
+++ b/main/manager.c
@@ -206,10 +206,10 @@ static char *authority_to_str(int authority, char *res, int reslen)
        for (i = 0; i < (sizeof(perms) / sizeof(perms[0])) - 1; i++) {
                if (authority & perms[i].num) {
                        if (*res) {
-                               strncat(res, ",", (reslen > running_total) ? reslen - running_total : 0);
+                               strncat(res, ",", (reslen > running_total) ? reslen - running_total - 1 : 0);
                                running_total++;
                        }
-                       strncat(res, perms[i].label, (reslen > running_total) ? reslen - running_total : 0);
+                       strncat(res, perms[i].label, (reslen > running_total) ? reslen - running_total - 1 : 0);
                        running_total += strlen(perms[i].label);
                }
        }