Author: anthm Date: Mon Sep 25 16:04:40 2006 New Revision: 2833 Modified: freeswitch/trunk/src/mod/event_handlers/mod_event_socket/mod_event_socket.c Log: remove potential buffer overrun Modified: freeswitch/trunk/src/mod/event_handlers/mod_event_socket/mod_event_socket.c ============================================================================== --- freeswitch/trunk/src/mod/event_handlers/mod_event_socket/mod_event_socket.c (original) +++ freeswitch/trunk/src/mod/event_handlers/mod_event_socket/mod_event_socket.c Mon Sep 25 16:04:40 2006 @@ -228,7 +228,7 @@ static switch_status_t read_packet(listener_t *listener, switch_event_t **event, uint32_t timeout) { switch_size_t mlen; - char mbuf[1024] = ""; + char mbuf[2048] = ""; char buf[1024] = ""; switch_size_t len; switch_status_t status = SWITCH_STATUS_SUCCESS; @@ -238,7 +238,7 @@ void *pop; char *ptr; uint8_t crcount = 0; - + uint32_t max_len = sizeof(mbuf); *event = NULL; start = time(NULL); ptr = mbuf; @@ -253,12 +253,13 @@ } if (mlen) { - bytes++; + bytes += mlen; do_sleep = 0; if (*mbuf == '\r' || *mbuf == '\n') { /* bah */ ptr = mbuf; mbuf[0] = '\0'; + bytes = 0; continue; } @@ -268,10 +269,15 @@ crcount = 0; } ptr++; + + if (bytes >= max_len) { + crcount = 2; + } + if (crcount == 2) { char *next; char *cur = mbuf; - + bytes = 0; while(cur) { if ((next = strchr(cur, '\r')) || (next = strchr(cur, '\n'))) { while (*next == '\r' || *next == '\n') {