| 00:31.48 | *** part/#asterisk-dev mjordan (~mjordan@nat/digium/x-enkphednurkellhq) |
| 01:19.46 | *** join/#asterisk-dev GameGamer43 (uid5533@gateway/web/irccloud.com/x-szaduzrahedfmijy) |
| 01:33.58 | *** join/#asterisk-dev snuff-work (~snuffy@210.8.167.13) |
| 01:33.58 | *** mode/#asterisk-dev [+o snuff-work] by ChanServ |
| 03:07.23 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |
| 05:22.51 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.124.24) |
| 06:04.53 | *** join/#asterisk-dev bulkorok (~chatzilla@85.183.61.47) |
| 06:23.43 | *** join/#asterisk-dev dwayne (~dwayne@c-71-207-208-112.hsd1.al.comcast.net) |
| 06:42.32 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.124.96) |
| 06:48.08 | *** join/#asterisk-dev hehol (~hehol@2001:1438:1009:200:c552:31df:9bee:2ec6) |
| 07:12.16 | *** join/#asterisk-dev leifmadsen (~Leif@asterisk/documenteur-extraordinaire/blitzrage) |
| 07:12.16 | *** mode/#asterisk-dev [+o leifmadsen] by ChanServ |
| 07:53.33 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.124.238) |
| 08:26.16 | *** join/#asterisk-dev sjava (~root@91.204.65.70) |
| 08:26.55 | sjava | mb any news about firefox and asterisk ? |
| 08:26.56 | sjava | :) |
| 08:27.06 | sjava | fingerprint, sha-256 |
| 08:27.07 | sjava | .. |
| 08:27.10 | sjava | support |
| 08:28.04 | sjava | tried freeswitch, firefox works good |
| 08:28.11 | sjava | but i want asterisk to support :( |
| 08:29.26 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.124.238) |
| 08:36.15 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.124.238) |
| 09:50.26 | *** join/#asterisk-dev vlad_starkov (~vlad_star@91.206.59.15) |
| 11:00.15 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 11:00.34 | *** join/#asterisk-dev zerohalo (~zerohalo@c-174-62-142-83.hsd1.ma.comcast.net) |
| 11:04.06 | *** join/#asterisk-dev italorossi (~italoross@187.60.66.11) |
| 11:27.48 | *** join/#asterisk-dev tzafrir (~tzafrir@local.xorcom.com) |
| 11:27.49 | *** mode/#asterisk-dev [+o tzafrir] by ChanServ |
| 11:39.47 | *** join/#asterisk-dev pc-m (~pcm@modemcable094.94-70-69.static.videotron.ca) |
| 12:44.50 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |
| 13:10.41 | file | opticron, there's an API function for retrieving an endpoint given a name |
| 13:11.51 | opticron | ok, thanks |
| 13:16.52 | opticron | for ast_sip_endpoints? |
| 13:17.15 | file | yes |
| 13:18.17 | file | at least I coulda swore there was |
| 13:18.49 | file | okay I lied |
| 13:18.51 | file | CARRY ON |
| 13:19.26 | opticron | :) |
| 13:36.17 | *** join/#asterisk-dev elguero (~miguel323@2001:470:1f06:12c4::2) |
| 13:56.08 | *** join/#asterisk-dev putnopvut (~putnopvut@asterisk/master-of-queues/mmichelson) |
| 13:56.08 | *** mode/#asterisk-dev [+o putnopvut] by ChanServ |
| 14:04.03 | *** join/#asterisk-dev mjordan (~mjordan@nat/digium/x-jlpnqqrqohlhjefn) |
| 14:04.03 | *** mode/#asterisk-dev [+o mjordan] by ChanServ |
| 14:10.28 | *** join/#asterisk-dev sruffell (~sruffell@asterisk/the-kernel-guy/sruffell) |
| 14:10.28 | *** mode/#asterisk-dev [+o sruffell] by ChanServ |
| 14:45.37 | *** join/#asterisk-dev pabelanger (~pabelange@asterisk/contributor-and-bug-marshal/pabelanger) |
| 14:45.37 | *** mode/#asterisk-dev [+o pabelanger] by ChanServ |
| 15:09.18 | *** join/#asterisk-dev hehol (~Adium@2a01:198:71d:0:81f5:3f31:9c9:3b88) |
| 15:36.15 | tzafrir | I ask again: what's wrong with strtol() and atoi() ? |
| 15:36.37 | tzafrir | See comments on https://reviewboard.asterisk.org/r/1598 |
| 15:37.05 | tzafrir | Actually the code there shows something that is wrong with strtol() - |
| 15:37.51 | tzafrir | Unlike the what claimed in the review comment: strtol can check that the number is valid (and the code does so) |
| 15:38.15 | tzafrir | But the code lacks the simple sanity check that the value must be > 0 |
| 15:38.59 | tzafrir | Any reason not to use atoi() there and not worry about buggy libc-s? |
| 15:55.18 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |
| 16:20.00 | mjordan | tzafrir: the reasoning typically given follows two points: |
| 16:20.01 | mjordan | (1) atoi doesn't detect errors (returns 0). If 0 is also an acceptable value, you can accept off-nominal input when you shouldn't. |
| 16:21.17 | mjordan | (2) you can't length limit the input given and protect against integer overflow. |
| 16:21.30 | mjordan | if the input is coming from an external source, atoi can lead to vulnerabilities |
| 16:21.47 | mjordan | so, the preferred mechanism in all cases is the scanf family of functions |
| 16:21.59 | mjordan | now, those two cases *may* not apply in your case - I haven't looked |
| 16:22.33 | mjordan | but for maintainability purposes - wherein someone comes along and modifies the code such that an atoi is used on unvalidated input - we usually prefer sscanf/etc. |
| 16:23.25 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |
| 16:31.01 | *** join/#asterisk-dev kharwell (~kharwell@nat/digium/x-qgzvdcoeahgcivpe) |
| 16:33.05 | tzafrir | I just checked with atoi here. Up to a point atoi may overflow . For overly large numbers it will return -1 and errno is 34: Numerical result out of range |
| 16:33.56 | tzafrir | In my case I don't really care what the original value is, so I have no problem with overflowing |
| 16:34.30 | tzafrir | I do my sanity test on the result of atoi(). And 0 is not a valid value, so (1) is not a concern |
| 16:35.19 | tzafrir | With both strtol and sscanf() I must check their validity checks anyway, and also check that the value is > 0 |
| 16:36.43 | tzafrir | BTW: which broken libc-s does AST-2009-005 (the one from which "%30d" originated) refer to? |
| 16:38.38 | Corydon76-work | tzafrir: NetBSD |
| 16:40.56 | Corydon76-work | They use (or used) a static buffer of 256 chars to convert numbers, and when somebody provided a longer number (usually prefixed with lots of zeros, so there wasn't an actual numeric overflow), stack smashing could result. |
| 16:43.24 | *** join/#asterisk-dev hehol (~Adium@2a01:198:71d:0:81f5:3f31:9c9:3b88) |
| 17:05.14 | tzafrir | Well, no such static buffer in netbsd's atoi/strtol . At least not since 2003 |
| 17:25.07 | *** join/#asterisk-dev kharwell (~kharwell@nat/digium/x-haljpgkqxzhtbkiw) |
| 18:11.15 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.125.159) |
| 18:24.27 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.125.159) |
| 18:39.14 | *** part/#asterisk-dev kharwell (~kharwell@nat/digium/x-haljpgkqxzhtbkiw) |
| 18:39.42 | *** join/#asterisk-dev kharwell (~kharwell@nat/digium/x-haljpgkqxzhtbkiw) |
| 19:20.40 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |
| 20:52.13 | *** join/#asterisk-dev [TK]D-Fender (~chatzilla@64.235.216.2) |
| 21:05.17 | *** join/#asterisk-dev pabelanger (~pabelange@asterisk/contributor-and-bug-marshal/pabelanger) |
| 21:05.17 | *** mode/#asterisk-dev [+o pabelanger] by ChanServ |
| 21:30.14 | *** join/#asterisk-dev leedm777 (~leedm777@nat/digium/x-mywyivvhcusejivq) |
| 21:44.18 | *** join/#asterisk-dev kharwell (~kharwell@nat/digium/x-yiumezzqffnyjssw) |
| 22:28.30 | *** join/#asterisk-dev italorossi (~italoross@187.60.66.11) |
| 22:50.53 | *** part/#asterisk-dev mjordan (~mjordan@nat/digium/x-jlpnqqrqohlhjefn) |
| 22:50.55 | *** join/#asterisk-dev vlad_starkov (~vlad_star@109.188.125.159) |
| 23:02.25 | *** join/#asterisk-dev moy (~moy@UNVLON55-1176057127.sdsl.bell.ca) |
| 23:45.52 | *** join/#asterisk-dev w9sh (~sph@50-79-224-193-static.hfc.comcastbusiness.net) |