pstn-free/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk synced 2026-08-07 10:32:13 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

chan_unistim.c: Prevent overrun of phone_number field.

Browse source 
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5
This commit is contained in:
George Joseph 2026-06-15 07:41:10 -06:00
parent 9e0386c6d2
commit ff65e4b086
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
channels/chan_unistim.c
View file

@ -456,6 +456,8 @@ static struct unistim_device {
struct unistim_device *next;
} *devices = NULL;
#define MAX_PHONE_NUMBER_LENGTH (AST_MAX_EXTENSION - 1)
static struct unistimsession {
ast_mutex_t lock;
struct sockaddr_in sin; /*!< IP address of the phone */
@ -3578,6 +3580,12 @@ static void key_dial_page(struct unistimsession *pte, char keycode)
if ((keycode >= KEY_0) && (keycode <= KEY_SHARP)) {
int i = pte->device->size_phone_number;
/*
* If the phone_number buffer is already full, bail now to prevent an overrun.
*/
if (pte->device->size_phone_number >= MAX_PHONE_NUMBER_LENGTH) {
return;
}
if (pte->device->size_phone_number == 0) {
send_tone(pte, 0, 0);
}