[sr-dev] git:4.1: core: xavp: Fix xavp_insert to prevent corrupted linked lists

[Hugh Waite]

Module: sip-router
Branch: 4.1
Commit: 58746ce4966b254cb465045cb517f652a24a5317
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=58746ce4966b254cb465045cb517f652a24a5317

Author: Hugh Waite <hugh.waite at acision.com>
Committer: Hugh Waite <hugh.waite at acision.com>
Date:   Wed Oct  8 19:01:20 2014 +0100

core: xavp: Fix xavp_insert to prevent corrupted linked lists

- Inserting data at a given index will pad the xavp with XTYPE_NULL entries
- Inserting data will replace a NULL entry if present
(cherry picked from commit 1828c8ab644243878fc6db9ff0f2592e656dc09a)

---

 xavp.c |   34 +++++++++++++++++++---------------
 1 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/xavp.c b/xavp.c
index 5f51731..0d73fd3 100644
--- a/xavp.c
+++ b/xavp.c
@@ -694,44 +694,48 @@ sr_xavp_t *xavp_clone_level_nodata(sr_xavp_t *xold)
 int xavp_insert(sr_xavp_t *xavp, int idx, sr_xavp_t **list)
 {
 	sr_xavp_t *crt = 0;
-	sr_xavp_t *fst = 0;
 	sr_xavp_t *lst = 0;
 	sr_xval_t val;
 	int n = 0;
 	int i = 0;
 
-	if(idx==0)
+	crt = xavp_get_internal(&xavp->name, list, 0, NULL);
+
+	if (idx == 0 && (!crt || crt->val.type != SR_XTYPE_NULL))
 		return xavp_add(xavp, list);
 
-	crt = xavp_get_internal(&xavp->name, list, 0, 0);
 	while(crt!=NULL && n<idx) {
 		lst = crt;
 		n++;
 		crt = xavp_get_next(lst);
 	}
+
+	if (crt && crt->val.type == SR_XTYPE_NULL) {
+		xavp->next = crt->next;
+		crt->next = xavp;
+
+		xavp_rm(crt, list);
+		return 0;
+	}
+
 	memset(&val, 0, sizeof(sr_xval_t));
 	val.type = SR_XTYPE_NULL;
 	for(i=0; i<idx-n; i++) {
-		crt = xavp_add_value(&xavp->name, &val, list);
+		crt = xavp_new_value(&xavp->name, &val);
 		if(crt==NULL)
 			return -1;
-		if(fst==NULL)
-			fst = crt;
-		if(lst==NULL) {
-			if(xavp_add(crt, list)<0)
-				return -1;
+		if (lst == NULL) {
+			crt->next = *list;
+			*list = crt;
 		} else {
 			crt->next = lst->next;
 			lst->next = crt;
 		}
+		lst = crt;
 	}
 
-	if(fst==NULL) {
-		return xavp_add(xavp, list);
-	} else {
-		xavp->next = fst->next;
-		fst->next = xavp;
-	}
+	xavp->next = lst->next;
+	lst->next = xavp;
 
 	return 0;
 }