Since passing \0 as the second argument to strchr is valid (and will

match the trailing \0 of a string) we need to check that first, otherwise
we end up with incorrect results.  Fix suggested by reporter.

(closes issue #13787)
Reported by: meitinger

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@152059 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/funcs/func_strings.c b/funcs/func_strings.c
index 793b016b17db7bd71d58a301351b91683b49a929..2b4c43c804d229931e87c11e5f9c3e11996198d9 100644 (file)
--- a/funcs/func_strings.c
+++ b/funcs/func_strings.c
@@ -573,7 +573,10 @@ static int keypadhash(struct ast_channel *chan, char *cmd, char *data, char *buf
        char *bufptr, *dataptr;
 
        for (bufptr = buf, dataptr = data; bufptr < buf + len - 1; dataptr++) {
-               if (*dataptr == '1') {
+               if (*dataptr == '\0') {
+                       *bufptr++ = '\0';
+                       break;
+               } else if (*dataptr == '1') {
                        *bufptr++ = '1';
                } else if (strchr("AaBbCc2", *dataptr)) {
                        *bufptr++ = '2';
@@ -593,9 +596,6 @@ static int keypadhash(struct ast_channel *chan, char *cmd, char *data, char *buf
                        *bufptr++ = '9';
                } else if (*dataptr == '0') {
                        *bufptr++ = '0';
-               } else if (*dataptr == '\0') {
-                       *bufptr++ = '\0';
-                       break;
                }
        }
        buf[len - 1] = '\0';