Author: mikej Date: Wed Jun 10 13:02:08 2009 New Revision: 13750 Log: bounds checking (FSCORE-380) Modified: freeswitch/trunk/src/switch_core_asr.c freeswitch/trunk/src/switch_core_speech.c Modified: freeswitch/trunk/src/switch_core_asr.c ============================================================================== --- freeswitch/trunk/src/switch_core_asr.c (original) +++ freeswitch/trunk/src/switch_core_asr.c Wed Jun 10 13:02:08 2009 @@ -126,8 +126,8 @@ if (!switch_strlen_zero(param_string)) { char *param[256] = { 0 }; int i; - switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0]))); - for (i = 0; param[i]; ++i) { + int argc = switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0]))); + for (i = 0; i < argc && param[i]; ++i) { char *param_pair[2] = { 0 }; if(switch_separate_string(param[i], '=', param_pair, (sizeof(param_pair) / sizeof(param_pair[0]))) == 2) { switch_core_asr_text_param(ah, param_pair[0], param_pair[1]); Modified: freeswitch/trunk/src/switch_core_speech.c ============================================================================== --- freeswitch/trunk/src/switch_core_speech.c (original) +++ freeswitch/trunk/src/switch_core_speech.c Wed Jun 10 13:02:08 2009 @@ -137,8 +137,8 @@ if (!switch_strlen_zero(param_string)) { char *param[256] = { 0 }; int i; - switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0]))); - for (i = 0; param[i]; ++i) { + int argc = switch_separate_string(param_string, ',', param, (sizeof(param) / sizeof(param[0]))); + for (i = 0; i < argc && param[i]; ++i) { char *param_pair[2] = { 0 }; if(switch_separate_string(param[i], '=', param_pair, (sizeof(param_pair) / sizeof(param_pair[0]))) == 2) { switch_core_speech_text_param_tts(sh, param_pair[0], param_pair[1]);