[sr-dev] git:master: Fix bug which causes an error during the convertion from string to timeb

[Sven Knoblich]

Module: sip-router
Branch: master
Commit: 61b184441ae41d08c9af06bc5192453f6f424d20
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=61b184441ae41d08c9af06bc5192453f6f424d20

Author: Sven Knoblich <sven.knoblich at 1und1.de>
Committer: Sven Knoblich <sven.knoblich at 1und1.de>
Date:   Wed Sep 14 14:43:32 2011 +0200

Fix bug which causes an error during the convertion from string to timeb

- add buffer in time_from_string. copy given string into buffer and finish it with '\0' to use c-string functions correctly.

---

 modules_k/acc/acc_cdr.c |   48 ++++++++++++++++++++++++++++++----------------
 1 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/modules_k/acc/acc_cdr.c b/modules_k/acc/acc_cdr.c
index c2ecf44..9595718 100644
--- a/modules_k/acc/acc_cdr.c
+++ b/modules_k/acc/acc_cdr.c
@@ -46,6 +46,8 @@
 
 #include <sys/timeb.h>
 
+#define TIME_STR_BUFFER_SIZE 20
+
 struct dlg_binds dlgb;
 struct acc_extra* cdr_extra = NULL;
 int cdr_facility = LOG_DAEMON;
@@ -196,37 +198,49 @@ static int write_cdr( struct dlg_cell* dialog,
 
 /* convert a string into a timeb struct */
 static struct timeb time_from_string( str* time_value)
-{
-    char* point_adresse = NULL;
-    int point_position = -1;
+{    
+    char* dot_adress = NULL;
+    int dot_position = -1;
+    char zero_terminated_value[TIME_STR_BUFFER_SIZE];
 
     if( !time_value)
     {
         LM_ERR( "time_value is empty!");
         return time_error;
     }
-
-    point_adresse = strchr( time_value->s, time_separator);
-
-    if( !point_adresse)
+    
+    if( time_value->len >= TIME_STR_BUFFER_SIZE)
+    {
+        LM_ERR( "time_value is to long %d >= %d!", 
+		time_value->len, 
+		TIME_STR_BUFFER_SIZE);
+        return time_error;
+    }
+    
+    memcpy( zero_terminated_value, time_value->s, time_value->len);
+    zero_terminated_value[time_value->len] = '\0';
+    
+    dot_adress = strchr( zero_terminated_value, time_separator);
+    
+    if( !dot_adress)
     {
         LM_ERR( "failed to find separator('%c') in '%s'!\n",
                 time_separator,
-                time_value->s);
+                zero_terminated_value);
         return time_error;
     }
-
-    point_position = point_adresse-time_value->s + 1;
-
-    if( point_position >= strlen(time_value->s) ||
-        strchr(point_adresse + 1, time_separator))
+    
+    dot_position = dot_adress-zero_terminated_value + 1;
+    
+    if( dot_position >= strlen(zero_terminated_value) ||
+        strchr(dot_adress + 1, time_separator))
     {
-        LM_ERR( "invalid time-string '%s'\n", time_value->s);
+        LM_ERR( "invalid time-string '%s'\n", zero_terminated_value);
         return time_error;
     }
-
-    return (struct timeb) { atoi( time_value->s),
-                            atoi( point_adresse + 1),
+    
+    return (struct timeb) { atoi( zero_terminated_value),
+                            atoi( dot_adress + 1),
                             0,
                             0};
 }