From 06cde577feeecce690f471fe6e092ab8b017b47c Mon Sep 17 00:00:00 2001 From: Kirill Solomko Date: Wed, 21 Aug 2019 13:09:49 +0200 Subject: [PATCH] TT#59353 escape callid in sql statements * callid that is used in sql statements is now escaped, Change-Id: I33b70179453eadd598d6dcb75f0344493f1a63e4 --- medmysql.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/medmysql.c b/medmysql.c index 9a0eeb9..71299f9 100644 --- a/medmysql.c +++ b/medmysql.c @@ -380,12 +380,16 @@ int medmysql_fetch_records(med_callid_t *callid, int ret = 0; int len; + char esc_callid[sizeof(((med_callid_t*)0)->value)*2+1]; + *count = 0; + mysql_real_escape_string(med_handler->m, esc_callid, callid->value, strlen(callid->value)); + len = snprintf(query, sizeof(query), MED_FETCH_QUERY, - callid->value, - callid->value, callid->value, - callid->value, callid->value); + esc_callid, + esc_callid, esc_callid, + esc_callid, esc_callid); assert(len < sizeof(query)); /* truncated - internal bug */ @@ -446,6 +450,10 @@ out: /**********************************************************************/ int medmysql_trash_entries(const char *callid, struct medmysql_batches *batches) { + char esc_callid[strlen(callid)*2+1]; + + mysql_real_escape_string(med_handler->m, esc_callid, callid, strlen(callid)); + if (batches->acc_trash.len > (PACKET_SIZE - 1024)) { if (medmysql_flush_medlist(&batches->acc_trash)) return -1; @@ -454,14 +462,18 @@ int medmysql_trash_entries(const char *callid, struct medmysql_batches *batches) if (batches->acc_trash.len == 0) batches->acc_trash.len = sprintf(batches->acc_trash.str, "insert into acc_trash (method, from_tag, to_tag, callid, sip_code, sip_reason, time, time_hires, src_leg, dst_leg, dst_user, dst_ouser, dst_domain, src_user, src_domain) select method, from_tag, to_tag, callid, sip_code, sip_reason, time, time_hires, src_leg, dst_leg, dst_user, dst_ouser, dst_domain, src_user, src_domain from acc where callid in ("); - batches->acc_trash.len += sprintf(batches->acc_trash.str + batches->acc_trash.len, "'%s',", callid); + batches->acc_trash.len += sprintf(batches->acc_trash.str + batches->acc_trash.len, "'%s',", esc_callid); - return medmysql_delete_entries(callid, batches); + return medmysql_delete_entries(esc_callid, batches); } /**********************************************************************/ int medmysql_backup_entries(const char *callid, struct medmysql_batches *batches) { + char esc_callid[strlen(callid)*2+1]; + + mysql_real_escape_string(med_handler->m, esc_callid, callid, strlen(callid)); + if (batches->acc_backup.len > (PACKET_SIZE - 1024)) { if (medmysql_flush_medlist(&batches->acc_backup)) return -1; @@ -470,9 +482,9 @@ int medmysql_backup_entries(const char *callid, struct medmysql_batches *batches if (batches->acc_backup.len == 0) batches->acc_backup.len = sprintf(batches->acc_backup.str, "insert into acc_backup (method, from_tag, to_tag, callid, sip_code, sip_reason, time, time_hires, src_leg, dst_leg, dst_user, dst_ouser, dst_domain, src_user, src_domain) select method, from_tag, to_tag, callid, sip_code, sip_reason, time, time_hires, src_leg, dst_leg, dst_user, dst_ouser, dst_domain, src_user, src_domain from acc where callid in ("); - batches->acc_backup.len += sprintf(batches->acc_backup.str + batches->acc_backup.len, "'%s',", callid); + batches->acc_backup.len += sprintf(batches->acc_backup.str + batches->acc_backup.len, "'%s',", esc_callid); - return medmysql_delete_entries(callid, batches); + return medmysql_delete_entries(esc_callid, batches); }