Changeset 4826

Timestamp:

Apr 24, 2014 9:45:52 AM (11 years ago)

Author:

riza

Message:

Misc (re #1751): Fix crash when retrieving dynamic choice(video stream info) caused by the use of invalid array index.

File:

• pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app_cli.c (modified) (11 diffs)

pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app_cli.c

@@ -370 +370 @@
                 /* Fill buddy id */
                 pj_ansi_snprintf(data_out, sizeof(data_out), "%d", ids[i]+1);
-                pj_strdup2(param->pool, &param->choice[i].value, data_out);
+                pj_strdup2(param->pool, &param->choice[param->cnt].value, 
+                           data_out);
                 pj_bzero(data_out, PJ_ARRAY_SIZE(data_out));
 
@@ -382 +383 @@
                                 info.uri.ptr);
 
-                pj_strdup2(param->pool, &param->choice[i].desc, data_out);
+                pj_strdup2(param->pool, &param->choice[param->cnt].desc, 
+                           data_out);
                 if (++param->cnt >= (param->max_cnt-1))
                     break;
@@ -390 +392 @@
             /* Add URL input option */
             pj_ansi_snprintf(data_out, sizeof(data_out), "URL");
-            pj_strdup2(param->pool, &param->choice[i].value, data_out);
+            pj_strdup2(param->pool, &param->choice[param->cnt].value, data_out);
             pj_ansi_snprintf(data_out, sizeof(data_out), "An URL");
-            pj_strdup2(param->pool, &param->choice[i].desc, data_out);
+            pj_strdup2(param->pool, &param->choice[param->cnt].desc, data_out);
             ++param->cnt;
         }
@@ -425 +427 @@
             pj_bzero(buf, sizeof(buf));
             pj_ansi_snprintf(buf, sizeof(buf), "%d", acc_ids[i]);
-            pj_strdup2(param->pool, &param->choice[i].value, buf);
-            pj_strdup2(param->pool, &param->choice[i].desc, buf_out);
+            pj_strdup2(param->pool, &param->choice[param->cnt].value, buf);
+            pj_strdup2(param->pool, &param->choice[param->cnt].desc, buf_out);
             if (++param->cnt >= param->max_cnt)
                 break;
@@ -452 +454 @@
         pj_ansi_snprintf(slot_id, sizeof(slot_id),
                          "%d", info.slot_id);
-        pj_strdup2(param->pool, &param->choice[i].value, slot_id);
+        pj_strdup2(param->pool, &param->choice[param->cnt].value, slot_id);
 
         txlist[0] = '\0';
@@ -471 +473 @@
                txlist);
 
-        pj_strdup2(param->pool, &param->choice[i].desc, desc);
+        pj_strdup2(param->pool, &param->choice[param->cnt].desc, desc);
         if (++param->cnt >= param->max_cnt)
             break;
@@ -521 +523 @@
                     pj_ansi_snprintf(med_idx, sizeof(med_idx), "%d",
                                      call_info.media[i].index);
-                    pj_strdup2(param->pool, &param->choice[i].value, med_idx);
+                    pj_strdup2(param->pool, &param->choice[param->cnt].value, 
+                               med_idx);
 
                     switch (call_info.media[i].status) {
                     case PJSUA_CALL_MEDIA_NONE:
-                        pj_strdup2(param->pool, &param->choice[i].desc,
+                        pj_strdup2(param->pool, &param->choice[param->cnt].desc,
                                    "Status:None");
                         break;
                     case PJSUA_CALL_MEDIA_ACTIVE:
-                        pj_strdup2(param->pool, &param->choice[i].desc,
+                        pj_strdup2(param->pool, &param->choice[param->cnt].desc,
                                    "Status:Active");
                         break;
                     case PJSUA_CALL_MEDIA_LOCAL_HOLD:
-                        pj_strdup2(param->pool, &param->choice[i].desc,
+                        pj_strdup2(param->pool, &param->choice[param->cnt].desc,
                                    "Status:Local Hold");
                         break;
                     case PJSUA_CALL_MEDIA_REMOTE_HOLD:
-                        pj_strdup2(param->pool, &param->choice[i].desc,
+                        pj_strdup2(param->pool, &param->choice[param->cnt].desc,
                                    "Status:Remote Hold");
                         break;
                     case PJSUA_CALL_MEDIA_ERROR:
-                        pj_strdup2(param->pool, &param->choice[i].desc,
+                        pj_strdup2(param->pool, &param->choice[param->cnt].desc,
                                    "Status:Media Error");
                         break;
@@ -655 +658 @@
             pjsua_vid_win_get_info(wids[i], &wi);
             pj_ansi_snprintf(win_id, sizeof(win_id), "%d", wids[i]);
-            pj_strdup2(param->pool, &param->choice[i].value, win_id);
+            pj_strdup2(param->pool, &param->choice[param->cnt].value, win_id);
 
             pj_ansi_snprintf(desc, sizeof(desc),
@@ -662 +665 @@
                              wi.size.w, wi.size.h);
 
-            pj_strdup2(param->pool, &param->choice[i].desc, desc);
+            pj_strdup2(param->pool, &param->choice[param->cnt].desc, desc);
             if (++param->cnt >= param->max_cnt)
                 break;
@@ -690 +693 @@
                 pjsua_call_get_info(ids[i], &call_info);
                 pj_ansi_snprintf(call_id, sizeof(call_id), "%d", ids[i]);
-                pj_strdup2(param->pool, &param->choice[i].value, call_id);
+                pj_strdup2(param->pool, &param->choice[param->cnt].value, 
+                           call_id);
                 pj_ansi_snprintf(desc, sizeof(desc), "%.*s [%.*s]",
                     (int)call_info.remote_info.slen,
@@ -696 +700 @@
                     (int)call_info.state_text.slen,
                     call_info.state_text.ptr);
-                pj_strdup2(param->pool, &param->choice[i].desc, desc);
+                pj_strdup2(param->pool, &param->choice[param->cnt].desc, desc);
                 if (++param->cnt >= param->max_cnt)
                     break;