From 5cd8a53ae80685a79938831d82f7caa4c3dbd7de Mon Sep 17 00:00:00 2001
From: Chris Rienzo <chris@signalwire.com>
Date: Mon, 1 Nov 2021 13:50:26 +0000
Subject: [PATCH] [mod_voicemail_ivr] Fix array overflow
---
src/mod/applications/mod_voicemail_ivr/menu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/mod/applications/mod_voicemail_ivr/menu.c b/src/mod/applications/mod_voicemail_ivr/menu.c
index 79aa16b56e..8a21353c93 100644
--- a/src/mod/applications/mod_voicemail_ivr/menu.c
+++ b/src/mod/applications/mod_voicemail_ivr/menu.c
@@ -730,13 +730,15 @@ char *vmivr_menu_get_input_set(switch_core_session_t *session, vmivr_profile_t *
for (retry = menu->ivr_maximum_attempts; switch_channel_ready(channel) && retry > 0; retry--) {
int i;
+ int dtmfa_array_length = 0;
menu_instance_init(menu);
switch_event_add_header(menu->phrase_params, SWITCH_STACK_BOTTOM, "IVR-Retry-Left", "%d", retry);
/* Find the last entry and append this one to it */
- for (i=0; i < 16 && menu->dtmfa[i]; i++){
+ dtmfa_array_length = sizeof(menu->dtmfa) / sizeof(menu->dtmfa[0]);
+ for (i = 0; i < (dtmfa_array_length - 1) && menu->dtmfa[i]; i++){
}
menu->dtmfa[i] = (char *) input_mask;