[patch] 13-dundi-null-dereference.patch

13-dundi-null-dereference.patch (text/plain), 1.17 KB, created by Tony Vroon (RETIRED) on 2013-03-05 13:39:22 UTC

Upstream issue 21205
Link: https://issues.asterisk.org/jira/browse/ASTERISK-21205

Submitted upstream:   2013-03-05 07:06
For Asterisk version: 11.2.1
Patch by: Jaco Kroon

If a negative (error) return is received from dundi_lookup_internal, this is not handled 
correctly when assigning the result to the buffer. As such, use a signed integer in the 
assignment and do a proper comparison.

--- a/pbx/pbx_dundi.c	2013-03-05 15:07:00.523387892 +0200
+++ b/pbx/pbx_dundi.c	2013-03-05 15:18:49.512625981 +0200
@@ -4123,7 +4123,7 @@
 
 struct dundi_result_datastore {
 	struct dundi_result results[MAX_RESULTS];
-	unsigned int num_results;
+	int num_results;
 	unsigned int id;
 };
 
@@ -4255,7 +4255,7 @@
 	drds = datastore->data;
 
 	if (!strcasecmp(args.resultnum, "getnum")) {
-		snprintf(buf, len, "%u", drds->num_results);
+		snprintf(buf, len, "%u", drds->num_results < 0 ? 0 : drds->num_results);
 		res = 0;
 		goto finish;
 	}
@@ -4266,7 +4266,7 @@
 		goto finish;
 	}
 
-	if (num && num <= drds->num_results) {
+	if (num && drds->num_results > 0 && num <= drds->num_results) {
 		snprintf(buf, len, "%s/%s", drds->results[num - 1].tech, drds->results[num - 1].dest);
 		res = 0;
 	} else