kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-31 18:55:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

* Fixed create_process() allocation of process ID values.

Browse Source 
The allocated process IDs could overflow their respective
NT and TE fields.  Affects outgoing calls.


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@168622 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Richard Mudgett
2009-01-14 21:48:22 +00:00
parent f94caa935b
commit 1a80fbd577
1 changed files with 41 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
channels/misdn/isdn_lib.c
View File

@@ -769,7 +769,7 @@ static void clear_l3(struct misdn_stack *stack)
} }
} }
static int newteid=0; static int new_te_id = 0;
#define MAXPROCS 0x100 #define MAXPROCS 0x100
@@ -885,68 +885,64 @@ static int misdn_lib_get_short_status(struct misdn_stack *stack)
static int create_process (int midev, struct misdn_bchannel *bc) { static int create_process(int midev, struct misdn_bchannel *bc)
{
iframe_t ncr; iframe_t ncr;
int l3_id; int l3_id;
int i; int proc_id;
struct misdn_stack *stack=get_stack_by_bc(bc); struct misdn_stack *stack;
stack = get_stack_by_bc(bc);
if (stack->nt) { if (stack->nt) {
if (find_free_chan_in_stack(stack, bc, bc->channel_preselected?bc->channel:0, 0)<0) return -1; if (find_free_chan_in_stack(stack, bc, bc->channel_preselected ? bc->channel : 0, 0) < 0) {
cb_log(4,stack->port, " --> found channel: %d\n",bc->channel); return -1;
}
for (i=0; i <= MAXPROCS; i++) cb_log(4, stack->port, " --> found channel: %d\n", bc->channel);
if (stack->procids[i]==0) break;
for (proc_id = 0; proc_id < MAXPROCS; ++proc_id) {
if (i== MAXPROCS) { if (stack->procids[proc_id] == 0) {
break;
}
} /* end for */
if (proc_id == MAXPROCS) {
cb_log(0, stack->port, "Couldn't Create New ProcId.\n"); cb_log(0, stack->port, "Couldn't Create New ProcId.\n");
return -1; return -1;
} }
stack->procids[i]=1;
l3_id = 0xff00 | i; stack->procids[proc_id] = 1;
ncr.prim = CC_NEW_CR | REQUEST;
ncr.addr = (stack->upper_id | FLG_MSG_DOWN) ;
ncr.dinfo = l3_id;
ncr.len = 0;
l3_id = 0xff00 | proc_id;
bc->l3_id = l3_id; bc->l3_id = l3_id;
cb_log(3, stack->port, " --> new_l3id %x\n",l3_id); cb_log(3, stack->port, " --> new_l3id %x\n", l3_id);
} else {
} else {
if (stack->ptp || bc->te_choose_channel) { if (stack->ptp || bc->te_choose_channel) {
/* we know exactly which channels are in use */ /* we know exactly which channels are in use */
if (find_free_chan_in_stack(stack, bc, bc->channel_preselected?bc->channel:0, bc->dec)<0) return -1; if (find_free_chan_in_stack(stack, bc, bc->channel_preselected ? bc->channel : 0, bc->dec) < 0) {
cb_log(2,stack->port, " --> found channel: %d\n",bc->channel); return -1;
}
cb_log(2, stack->port, " --> found channel: %d\n", bc->channel);
} else { } else {
/* other phones could have made a call also on this port (ptmp) */ /* other phones could have made a call also on this port (ptmp) */
bc->channel=0xff; bc->channel = 0xff;
} }
/* if we are in te-mode, we need to create a process first */ /* if we are in te-mode, we need to create a process first */
if (newteid++ > 0xffff) if (++new_te_id > 0xffff) {
newteid = 0x0001; new_te_id = 0x0001;
}
l3_id = (entity<<16) | newteid;
/* preparing message */
ncr.prim = CC_NEW_CR | REQUEST;
ncr.addr = (stack->upper_id | FLG_MSG_DOWN) ;
ncr.dinfo =l3_id;
ncr.len = 0;
/* send message */
l3_id = (entity << 16) | new_te_id;
bc->l3_id = l3_id; bc->l3_id = l3_id;
cb_log(3, stack->port, "--> new_l3id %x\n",l3_id); cb_log(3, stack->port, "--> new_l3id %x\n", l3_id);
mISDN_write(midev, &ncr, mISDN_HEADER_LEN+ncr.len, TIMEOUT_1SEC); /* send message */
ncr.prim = CC_NEW_CR | REQUEST;
ncr.addr = (stack->upper_id | FLG_MSG_DOWN);
ncr.dinfo = l3_id;
ncr.len = 0;
mISDN_write(midev, &ncr, mISDN_HEADER_LEN + ncr.len, TIMEOUT_1SEC);
} }
return l3_id; return l3_id;
} }