kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged revisions 75444 via svnmerge from

Browse Source 
https://origsvn.digium.com/svn/asterisk/branches/1.2

........
r75444 | russell | 2007-07-17 15:45:27 -0500 (Tue, 17 Jul 2007) | 5 lines

Ensure that when encoding the contents of an ast_frame into an iax_frame, that
the size of the destination buffer is known in the iax_frame so that code
won't write past the end of the allocated buffer when sending outgoing frames.
(ASA-2007-014)

........


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@75445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2007-07-17 20:48:21 +00:00
parent 2193734456
commit 89497599be
3 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
channels/chan_iax2.c
View File

@@ -1121,10 +1121,10 @@ static struct iax_frame *iaxfrdup2(struct iax_frame *fr)
{
struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable);
if (new) {
size_t mallocd_datalen = new->mallocd_datalen;
size_t afdatalen = new->afdatalen;
memcpy(new, fr, sizeof(*new));
iax_frame_wrap(new, &fr->af);
new->mallocd_datalen = mallocd_datalen;
new->afdatalen = afdatalen;
new->data = NULL;
new->datalen = 0;
new->direction = DIRECTION_INGRESS;
@@ -3877,7 +3877,9 @@ static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned in
int sendmini=0;
unsigned int lastsent;
unsigned int fts;
frb.fr2.afdatalen = sizeof(frb.buffer);
if (!pvt) {
ast_log(LOG_WARNING, "No private structure for packet?\n");
return -1;
@@ -6462,6 +6464,7 @@ static int socket_process(struct iax2_thread *thread)
/* allocate an iax_frame with 4096 bytes of data buffer */
fr = alloca(sizeof(*fr) + 4096);
fr->callno = 0;
fr->afdatalen = 4096; /* From alloca() above */
/* Copy frequently used parameters to the stack */
res = thread->buf_len;