Author: mikej Date: Mon Dec 17 17:52:32 2007 New Revision: 6844 Modified: freeswitch/trunk/src/switch_channel.c freeswitch/trunk/src/switch_core_media_bug.c freeswitch/trunk/src/switch_ivr_originate.c Log: bounds checks and scope masked var names. Modified: freeswitch/trunk/src/switch_channel.c ============================================================================== --- freeswitch/trunk/src/switch_channel.c (original) +++ freeswitch/trunk/src/switch_channel.c Mon Dec 17 17:52:32 2007 @@ -635,9 +635,11 @@ switch_assert(channel != NULL); + switch_assert(state <= CS_DONE); switch_mutex_lock(channel->flag_mutex); last_state = channel->state; + switch_assert(last_state <= CS_DONE); if (last_state == state) { goto done; @@ -1498,19 +1500,19 @@ char *expanded = NULL; int offset = 0; int ooffset = 0; - char *p; + char *ptr; if ((expanded = switch_channel_expand_variables(channel, (char *)vname)) == vname) { expanded = NULL; } else { vname = expanded; } - if ((p = strchr(vname, ':'))) { - *p++ = '\0'; - offset = atoi(p); - if ((p = strchr(p, ':'))) { - p++; - ooffset = atoi(p); + if ((ptr = strchr(vname, ':'))) { + *ptr++ = '\0'; + offset = atoi(ptr); + if ((ptr = strchr(ptr, ':'))) { + ptr++; + ooffset = atoi(ptr); } } @@ -1528,8 +1530,8 @@ } if (ooffset > 0 && (size_t)ooffset < strlen(sub_val)) { - if ((p = (char *)sub_val + ooffset)) { - *p = '\0'; + if ((ptr = (char *)sub_val + ooffset)) { + *ptr = '\0'; } } Modified: freeswitch/trunk/src/switch_core_media_bug.c ============================================================================== --- freeswitch/trunk/src/switch_core_media_bug.c (original) +++ freeswitch/trunk/src/switch_core_media_bug.c Mon Dec 17 17:52:32 2007 @@ -128,9 +128,10 @@ bytes = (datalen > frame->datalen) ? datalen : frame->datalen; + switch_assert( bytes <= maxlen ); if (bytes) { - int16_t tmp[960], *tp = tmp; + int16_t tmp[SWITCH_RECOMMENDED_BUFFER_SIZE], *tp = tmp; dp = (int16_t *) data; fp = (int16_t *) frame->data; Modified: freeswitch/trunk/src/switch_ivr_originate.c ============================================================================== --- freeswitch/trunk/src/switch_ivr_originate.c (original) +++ freeswitch/trunk/src/switch_ivr_originate.c Mon Dec 17 17:52:32 2007 @@ -277,6 +277,13 @@ *bleg = NULL; odata = strdup(bridgeto); + + if (!odata) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Memory Error!\n"); + status = SWITCH_STATUS_MEMERR; + goto done; + } + data = odata; /* strip leading spaces */