func: static char *CVE_2008_1390_VULN_generic_http_callback(int format, struct sockaddr_in *requestor, const char *uri, struct ast_variable *params, int *status, char **title, int *contentlength) unsigned long ident = 0 ; if ( ! ( s = find_session ( ident ) ) )  if ( ! ( s = ast_calloc ( 1 , sizeof ( * s ) ) ) )  memcpy ( & s -> sin , requestor , sizeof ( s -> sin ) ); s -> fd = - 1; s -> waiting_thread = AST_PTHREADT_NULL; s -> send_events = 0; ast_mutex_init ( & s -> __lock ); ast_mutex_lock ( & s -> __lock ); s -> inuse = 1; s -> managerid = rand ( ) | ( unsigned long ) s; AST_LIST_INSERT_HEAD ( & sessions , s , list ); s -> eventq = master_eventq; while ( s -> eventq -> next )  s -> eventq = s -> eventq -> next; ast_atomic_fetchadd_int ( & s -> eventq -> usecount , 1 ); time ( & s -> sessiontimeout ); if ( ! s -> authenticated && ( httptimeout > 5 ) )  s -> sessiontimeout += 5; s -> sessiontimeout += httptimeout; ast_mutex_unlock ( & s -> __lock ); if ( s )  if ( process_message ( s , & m ) )  if ( s -> authenticated )  ast_verbose ( VERBOSE_PREFIX_2 "HTTP Manager '%s' logged off from %s\n" , s -> username , ast_inet_ntoa ( s -> sin . sin_addr ) ) ast_log ( LOG_EVENT , "HTTP Manager '%s' logged off from %s\n" , s -> username , ast_inet_ntoa ( s -> sin . sin_addr ) ); ast_verbose ( VERBOSE_PREFIX_2 "HTTP Connect attempt from '%s' unable to authenticate\n" , ast_inet_ntoa ( s -> sin . sin_addr ) ) ast_log ( LOG_EVENT , "HTTP Failed attempt from %s\n" , ast_inet_ntoa ( s -> sin . sin_addr ) ); s -> needdestroy = 1; sprintf ( tmp , "%08lx" , s -> managerid ); ast_build_string ( & c , & len , "%s\r\n" , ast_http_setcookie ( "mansession_id" , tmp , httptimeout , cookie , sizeof ( cookie ) ) ); ast_mutex_lock ( & s -> __lock ); if ( s -> outputstr )  tmp = xml_translate ( s -> outputstr -> str , params ); tmp = html_translate ( s -> outputstr -> str ); tmp = s -> outputstr -> str; if ( tmp )  retval = malloc ( strlen ( workspace ) + strlen ( tmp ) + 128 ); if ( retval )  strcpy ( retval , workspace ); strcpy ( retval + strlen ( retval ) , tmp ); c = retval + strlen ( retval ); if ( tmp != s -> outputstr -> str )  free ( tmp ); free ( s -> outputstr ); s -> outputstr = NULL; ast_mutex_unlock ( & s -> __lock ); ast_build_string ( & c , & len , "</ajax-response>\n" ); ast_build_string ( & c , & len , "</table></body>\r\n" ); ast_mutex_lock ( & s -> __lock ); if ( s -> needdestroy )  if ( s -> inuse == 1 )  if ( s -> waiting_thread != AST_PTHREADT_NULL )  pthread_kill ( s -> waiting_thread , SIGURG ); s -> inuse --; s -> inuse --; ast_mutex_unlock ( & s -> __lock ); destroy_session ( s ); return retval ; 