kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-18 18:58:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix a small logic error in ast_event_iterator_next. The previous logic allowed for the iterator

Browse Source 
to indicate there was more data than there really was, causing the iterator read beyond the end
of the event structure. This led to invalid memory reads and potential crashes.



git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@103559 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Mark Michelson
2008-02-13 00:55:09 +00:00
parent 69e6af44a5
commit 23fc97480e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
main/event.c
View File

@@ -383,7 +383,7 @@ void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct a
int ast_event_iterator_next(struct ast_event_iterator *iterator)
{
iterator->ie = (struct ast_event_ie *) ( ((char *) iterator->ie) + sizeof(*iterator->ie) + ntohs(iterator->ie->ie_payload_len));
return ((iterator->event_len < (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
return ((iterator->event_len <= (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
}
enum ast_event_ie_type ast_event_iterator_get_ie_type(struct ast_event_iterator *iterator)