{"action":"created","issue":{"url":"https://api.github.com/repos/rlaager/docsis/issues/22","labels_url":"https://api.github.com/repos/rlaager/docsis/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/rlaager/docsis/issues/22/comments","events_url":"https://api.github.com/repos/rlaager/docsis/issues/22/events","html_url":"https://github.com/rlaager/docsis/issues/22","id":112487111,"number":22,"title":"Bug concerning dialplan in docsis","user":{"login":"zuxy","id":3745922,"avatar_url":"https://avatars.githubusercontent.com/u/3745922?v=3","gravatar_id":"","url":"https://api.github.com/users/zuxy","html_url":"https://github.com/zuxy","followers_url":"https://api.github.com/users/zuxy/followers","following_url":"https://api.github.com/users/zuxy/following{/other_user}","gists_url":"https://api.github.com/users/zuxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zuxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zuxy/subscriptions","organizations_url":"https://api.github.com/users/zuxy/orgs","repos_url":"https://api.github.com/users/zuxy/repos","events_url":"https://api.github.com/users/zuxy/events{/privacy}","received_events_url":"https://api.github.com/users/zuxy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rlaager/docsis/labels/Bug","name":"Bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/rlaager/docsis/milestones/1","html_url":"https://github.com/rlaager/docsis/milestones/1.0%20Release","labels_url":"https://api.github.com/repos/rlaager/docsis/milestones/1/labels","id":1368146,"number":1,"title":"1.0 Release","description":"","creator":{"login":"AdrianSimionov","id":6671693,"avatar_url":"https://avatars.githubusercontent.com/u/6671693?v=3","gravatar_id":"","url":"https://api.github.com/users/AdrianSimionov","html_url":"https://github.com/AdrianSimionov","followers_url":"https://api.github.com/users/AdrianSimionov/followers","following_url":"https://api.github.com/users/AdrianSimionov/following{/other_user}","gists_url":"https://api.github.com/users/AdrianSimionov/gists{/gist_id}","starred_url":"https://api.github.com/users/AdrianSimionov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AdrianSimionov/subscriptions","organizations_url":"https://api.github.com/users/AdrianSimionov/orgs","repos_url":"https://api.github.com/users/AdrianSimionov/repos","events_url":"https://api.github.com/users/AdrianSimionov/events{/privacy}","received_events_url":"https://api.github.com/users/AdrianSimionov/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":0,"state":"open","created_at":"2015-10-21T12:44:19Z","updated_at":"2015-10-21T12:44:35Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-10-21T00:25:22Z","updated_at":"2015-10-21T19:47:18Z","closed_at":null,"body":"The following lines inside docsis.c:add_dialplan() looks problematic:\r\n\r\n  **local_char = 0x16 + fileSize;**\r\n  **if (local_char < 0x80) {**\r\n    memcpy(tlvbuf + tlvbuflen, p_local_char, sizeof(local_char));\r\n    tlvbuflen += sizeof(local_char);\r\n  } else {\r\n    ...\r\n\r\nlocal_char is of type char, and the highlighted lines might overflow, and the resulting config file can't be recognized by PC2.0 eDVA.\r\n\r\nIntroducing an intermediate variable of type int can cure the problem:\r\n\r\n  local_char = local_char_w = 0x16 + fileSize;\r\n  if (local_char_w < 0x80) {\r\n    memcpy(tlvbuf + tlvbuflen, p_local_char, sizeof(local_char));\r\n    tlvbuflen += sizeof(local_char);\r\n  } else {\r\n   ..."},"comment":{"url":"https://api.github.com/repos/rlaager/docsis/issues/comments/150005770","html_url":"https://github.com/rlaager/docsis/issues/22#issuecomment-150005770","issue_url":"https://api.github.com/repos/rlaager/docsis/issues/22","id":150005770,"user":{"login":"rlaager","id":113383,"avatar_url":"https://avatars.githubusercontent.com/u/113383?v=3","gravatar_id":"","url":"https://api.github.com/users/rlaager","html_url":"https://github.com/rlaager","followers_url":"https://api.github.com/users/rlaager/followers","following_url":"https://api.github.com/users/rlaager/following{/other_user}","gists_url":"https://api.github.com/users/rlaager/gists{/gist_id}","starred_url":"https://api.github.com/users/rlaager/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlaager/subscriptions","organizations_url":"https://api.github.com/users/rlaager/orgs","repos_url":"https://api.github.com/users/rlaager/repos","events_url":"https://api.github.com/users/rlaager/events{/privacy}","received_events_url":"https://api.github.com/users/rlaager/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T19:47:18Z","updated_at":"2015-10-21T19:47:18Z","body":"The proposed change (assuming local_char_w is typed as an unsigned int) does not protect against integer overflow in the general case (which is insanely annoying to deal with in C), but does seem like a decent real-world fix.\r\n\r\nThat said, I have absolutely no idea what this code is trying to accomplish."}}