Serious bug in wml_compiler.c

[Vjacheslav Chekushin]

Hi, list.
There is bug in wml_compiler.c that forces wapbox panic
in some circumstances.
Problem is in string table.
string_table_add() returns unsigned long offset for new entry and
after that wml_compiler uses output_st_char()->octstr_append_char() to
add this offset to binary wml. It adds only u_int8, but offset
is mb_u_int32, so on large string tables octstr_append_char() PANIC on
Assertion `ch <= UCHAR_MAX'.

I attach wml file on which kannel panics and patch to eliminate this problem.

P.S.
Attached index.wml can be tested with test/wml_tester also.

--
Vjacheslav Chekushin                                mailto:[EMAIL PROTECTED]
Latvian Mobile Phone Company                        http://www.lmt.lv

index.wml.gz
Description: GNU Zip compressed data

wml_compliler.patch.gz
Description: GNU Zip compressed data

--- ../gateway-1.3.0_base/gw/wml_compiler.c     Sun Aug  4 13:00:03 2002
+++ gw/wml_compiler.c   Wed Jan 22 11:00:31 2003
@@ -529,7 +529,7 @@
                add_end_tag = 1;
        }
        output_st_char(wbxml_hex, wbxml);
-       output_st_char(string_table_add(octstr_duplicate(name), wbxml), wbxml);
+       
+octstr_append_uintvar((*wbxml)->wbxml_string,string_table_add(octstr_duplicate(name), 
+wbxml));
        warning(0, "WML compiler: Unknown tag in WML source: <%s>", 
                octstr_get_cstr(name));
     }
@@ -594,7 +594,7 @@
           string. */
        wbxml_hex = WBXML_LITERAL;
        output_st_char(wbxml_hex, wbxml);
-       output_st_char(string_table_add(octstr_duplicate(name), wbxml), wbxml);
+       
+octstr_append_uintvar((*wbxml)->wbxml_string,string_table_add(octstr_duplicate(name), 
+wbxml));
        warning(0, "WML compiler: Unknown attribute in WML source: <%s>", 
                octstr_get_cstr(name));
     }