kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-16 23:08:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't read past end of input when calling write()

Browse Source 
int blah = 1;
...
write(chan->alertpipe[1], &blah, new_frames * sizeof(blah)) !=
(new_frames * sizeof(blah)))

is only valid when new_frames == 1. Otherwise we start reading into adjacent
variables declared on the stack. The read end discards what is read, so the
values don't matter but it's not a good idea to read past where we want even
though new_frames is almost always 1 and should never be large. This patch is
basically taken out of kpfleming's eventfd branch, as he mentioned that he
remembered fixing it there when I talked to him about this issue.

Review: https://reviewboard.asterisk.org/r/1583/
........

Merged revisions 345163 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 345164 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@345165 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Terry Wilson
2011-11-14 19:12:49 +00:00
parent 6ef49c3214
commit 59d6db63bd
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
main/channel.c
View File

@@ -1413,7 +1413,6 @@ static int __ast_queue_frame(struct ast_channel *chan, struct ast_frame *fin, in
{
struct ast_frame *f;
struct ast_frame *cur;
int blah = 1;
unsigned int new_frames = 0;
unsigned int new_voice_frames = 0;
unsigned int queued_frames = 0;
@@ -1512,7 +1511,10 @@ static int __ast_queue_frame(struct ast_channel *chan, struct ast_frame *fin, in
}
if (chan->alertpipe[1] > -1) {
if (write(chan->alertpipe[1], &blah, new_frames * sizeof(blah)) != (new_frames * sizeof(blah))) {
int blah[new_frames];
memset(blah, 1, sizeof(blah));
if (write(chan->alertpipe[1], &blah, sizeof(blah)) != (sizeof(blah))) {
ast_log(LOG_WARNING, "Unable to write to alert pipe on %s (qlen = %d): %s!\n",
chan->name, queued_frames, strerror(errno));
}