[Home]

Summary:ASTERISK-04790: [patch] Pointer (& data) corrupted on exit from get_input() in manager.c whenever poll() fails
Reporter:Thomas (thomas andrews)Labels:
Date Opened:2005-08-07 11:39:02Date Closed:2011-06-07 14:03:12
Priority:MajorRegression?No
Status:Closed/CompleteComponents:Core/ManagerInterface
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) manager-missing-return.patch
Description:If poll() fails it returns -1. This error condition is not handled properly in get_input(), which continues to use the value returned by poll() as if it was valid. The result is corrupted data elsewhere. Consider res = -1 (from poll())
1. s->inlen += res;
2. s->inbuf[s->inlen] = '\0';
This is fixed by returning as soon as an error is detected.
Comments:By: Mark Spencer (markster) 2005-08-07 18:55:36

Fixed in CVS head, thanks!
By: Russell Bryant (russell) 2005-08-08 14:54:48

fixed in 1.0
By: Digium Subversion (svnbot) 2008-01-15 15:44:01.000-0600

Repository: asterisk
Revision: 6303

U   trunk/manager.c

------------------------------------------------------------------------
r6303 | markster | 2008-01-15 15:44:01 -0600 (Tue, 15 Jan 2008) | 2 lines

Fix poll error condition causing memory corruption (bug ASTERISK-4790)

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=6303
By: Digium Subversion (svnbot) 2008-01-15 15:44:08.000-0600

Repository: asterisk
Revision: 6311

U   branches/v1-0/manager.c

------------------------------------------------------------------------
r6311 | russell | 2008-01-15 15:44:07 -0600 (Tue, 15 Jan 2008) | 2 lines

Fix poll error condition causing memory corruption (bug ASTERISK-4790)

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=6311