Serious bug in wml_compiler.c
Vjacheslav Chekushin <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Organization | LMT |
| Message-ID | <[email protected]> |
Hi, list. There is bug in wml_compiler.c that forces wapbox panic in some circumstances. Problem is in string table. string_table_add() returns unsigned long offset for new entry and after that wml_compiler uses output_st_char()->octstr_append_char() to add this offset to binary wml. It adds only u_int8, but offset is mb_u_int32, so on large string tables octstr_append_char() PANIC on Assertion `ch <= UCHAR_MAX'. I attach wml file on which kannel panics and patch to eliminate this problem. P.S. Attached index.wml can be tested with test/wml_tester also. -- Vjacheslav Chekushin mailto:[email protected] Latvian Mobile Phone Company http://www.lmt.lv
index.wml.gz
(application/x-gzip, 2 KB) - not displayed
wml_compliler.patch.gz
(application/x-gzip, 369 B) - not displayed
wml_compliler.patch
(text/plain, 839 B)
--- ../gateway-1.3.0_base/gw/wml_compiler.c Sun Aug 4 13:00:03 2002
+++ gw/wml_compiler.c Wed Jan 22 11:00:31 2003
@@ -529,7 +529,7 @@
add_end_tag = 1;
}
output_st_char(wbxml_hex, wbxml);
- output_st_char(string_table_add(octstr_duplicate(name), wbxml), wbxml);
+ octstr_append_uintvar((*wbxml)->wbxml_string,string_table_add(octstr_duplicate(name), wbxml));
warning(0, "WML compiler: Unknown tag in WML source: <%s>",
octstr_get_cstr(name));
}
@@ -594,7 +594,7 @@
string. */
wbxml_hex = WBXML_LITERAL;
output_st_char(wbxml_hex, wbxml);
- output_st_char(string_table_add(octstr_duplicate(name), wbxml), wbxml);
+ octstr_append_uintvar((*wbxml)->wbxml_string,string_table_add(octstr_duplicate(name), wbxml));
warning(0, "WML compiler: Unknown attribute in WML source: <%s>",
octstr_get_cstr(name));
}