Re: [PATCH] voicecall: Limit tone string length per request.

[Denis Kenzior]

Hi Andrew,

On 10/25/2010 12:51 AM, Andrzej Zaborowski wrote:
> Also change to avoid memcpying into a buffer.
> ---
>  src/voicecall.c |   17 ++---
>  1 files changed, 10 insertions(+), 7 deletions(-)
> 

Patch has been applied, thanks.

Regards,
-Denis
___
ofono mailing list
ofono@ofono.org
http://lists.ofono.org/listinfo/ofono

[PATCH] voicecall: Limit tone string length per request.

[Andrzej Zaborowski]

Also change to avoid memcpying into a buffer.
---
 src/voicecall.c |   17 ++---
 1 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/voicecall.c b/src/voicecall.c
index 26cfb9a..bd64432 100644
--- a/src/voicecall.c
+++ b/src/voicecall.c
@@ -2472,7 +2472,7 @@ static gboolean tone_request_run(gpointer user_data)
 {
struct ofono_voicecall *vc = user_data;
struct tone_queue_entry *entry = g_queue_peek_head(vc->toneq);
-   char buf[256];
+   char final;
unsigned len;
 
vc->tone_source = 0;
@@ -2483,14 +2483,17 @@ static gboolean tone_request_run(gpointer user_data)
len = strcspn(entry->left, "pP");
 
if (len) {
-   if (len >= sizeof(buf))
-   len = sizeof(buf) - 1;
+   if (len > 8) /* Arbitrary length limit per request */
+   len = 8;
 
-   memcpy(buf, entry->left, len);
-   buf[len] = '\0';
-   entry->left += len;
+   /* Temporarily move the end of the string */
+   final = entry->left[len];
+   entry->left[len] = '\0';
+
+   vc->driver->send_tones(vc, entry->left, tone_request_cb, vc);
 
-   vc->driver->send_tones(vc, buf, tone_request_cb, vc);
+   entry->left += len;
+   entry->left[0] = final;
} else
tone_request_cb(NULL, vc);
 
-- 
1.7.1.86.g0e460.dirty

___
ofono mailing list
ofono@ofono.org
http://lists.ofono.org/listinfo/ofono