--- main/manager.c.orig 2010-04-15 15:44:51.000000000 -0300 +++ main/manager.c 2010-04-15 16:27:43.000000000 -0300 @@ -3896,9 +3896,9 @@ user pass
\n\ \n\n" - ast_str_append(&out, 0, "Asterisk™ Manager Interface"); + ast_str_append(&out, 0, "\r\nAsterisk™ Manager Interface\r\n"); ast_str_append(&out, 0, "\r\n"); - ast_str_append(&out, 0, ROW_FMT, "

Manager Tester

"); + ast_str_append(&out, 0, ROW_FMT, "

  Asterisk Manager Information  

"); ast_str_append(&out, 0, ROW_FMT, TEST_STRING); } @@ -3910,14 +3910,33 @@ fprintf(s.f, "%c", 0); if ((l = ftell(s.f))) { + /* Trying to stop the core dump */ + if ( l > 10480765 ) { + ast_log(LOG_WARNING, "Buffer Overflow Detected, memory size exceeded (%d bytes)\n", l); + fclose(s.f); + s.f = NULL; + s.fd = -1; + ast_mutex_unlock(&session->__lock); + *status = 500; + goto generic_callback_out; + } + if (MAP_FAILED == (buf = mmap(NULL, l, PROT_READ | PROT_WRITE, MAP_PRIVATE, s.fd, 0))) { ast_log(LOG_WARNING, "mmap failed. Manager output was not processed\n"); } else { - if (format == FORMAT_XML || format == FORMAT_HTML) - xml_translate(&out, buf, params, format); - else - ast_str_append(&out, 0, "%s", buf); + /* ensure that string is null-terminated */ + char *newbuf = ast_malloc(l + 1); + memcpy(newbuf, buf, l); + newbuf[l] = '\0'; + + if (format == FORMAT_XML || format == FORMAT_HTML) { + xml_translate(&out, newbuf, params, format); + } else { + ast_str_append(&out, 0, "%s", newbuf); + } + munmap(buf, l); + free(newbuf); } } else if (format == FORMAT_XML || format == FORMAT_HTML) { xml_translate(&out, "", params, format); @@ -3929,8 +3948,9 @@ if (format == FORMAT_XML) { ast_str_append(&out, 0, "\n"); - } else if (format == FORMAT_HTML) - ast_str_append(&out, 0, "
\r\n"); + } else if (format == FORMAT_HTML) { + ast_str_append(&out, 0, "\r\n"); + } ast_mutex_lock(&session->__lock); /* Reset HTTP timeout. If we're not authenticated, keep it extremely short */ @@ -3952,6 +3972,7 @@ if (blastaway) destroy_session(session); + generic_callback_out: if (*status != 200) return ast_http_error(500, "Server Error", NULL, "Internal Server Error (out of memory)\n");