Convert all release tags to Opsound music-on-hold.

For more details:
http://blogs.digium.com/2009/08/18/asterisk-music-on-hold-changes/



git-svn-id: https://origsvn.digium.com/svn/asterisk/tags/1.0.11@212958 65c4cc65-6c06-0410-ace0-fbb531ad65f3

.version

@@ -1 +1 @@
-1.0.12
+1.0.11

ChangeLog

@@ -1,25 +1,14 @@
  NOTE: Corrections or additions to the ChangeLog may be submitted to
        http://bugs.digium.com.  Documentation and formatting fixes are not
        not listed here.  A complete listing of changes is available through
-       the Asterisk-commits mailing list hosted at http://lists.digium.com.
+       the Asterisk-CVS mailing list hosted at http://lists.digium.com.
 
-Asterisk 1.0.12
-
- -- chan_skinny
-    -- An exploitable buffer overflow in this channel driver was fixed.
-	
-Asterisk 1.0.11.1
-
- -- chan_iax2
-    -- A bug in the vulnerability fix in the last release could cause Asterisk
-       to improperly reject incoming video frames and result in deadlocks.
-	
 Asterisk 1.0.11
 
  -- chan_iax2
     -- A security vulnerability that could lead to denial of service attacks
-       and Asterisk process crashes was fixed in this release.Asterisk 1.0.11
-
+       and Asterisk process crashes was fixed in this release.
+	
 Asterisk 1.0.10
 
  -- chan_local

channels/chan_iax2.c

@@ -5052,21 +5052,11 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr));
 		return 1;
 	}
-	if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
-		if (res < sizeof(*vh)) {
-			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a mini video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-			return 1;
-			
-		}
+	if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
 		/* This is a video frame, get call number */
 		fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1);
 		minivid = 1;
-	} else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
-		if (res < sizeof(*meta)) {
-			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-			return 1;
-			
-		}
+	} else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
 		/* This is a meta header */
 		switch(meta->metacmd) {
 		case IAX_META_TRUNK:
@@ -5159,7 +5149,14 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		}
 		return 1;
 	}
-
+	/* if we got here and ->zeros contains zeros, this cannot be a valid
+	   miniframe or full frame but it wasn't a valid video frame or meta
+	   frame either, so we reject it
+	*/
+	if (vh->zeros == 0) {
+		ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+		return 1;
+	}
 #ifdef DEBUG_SUPPORT
 	if (iaxdebug)
 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr));

channels/chan_skinny.c

@@ -2305,10 +2305,6 @@ static int get_input(struct skinnysession *s)
 			return -1;
 		}
 		dlen = *(int *)s->inbuf;
-		if (dlen < 0) {
-			ast_log(LOG_WARNING, "Skinny Client sent invalid data.\n");
-			return -1;
-		}
 		if (dlen+8 > sizeof(s->inbuf))
 			dlen = sizeof(s->inbuf) - 8;
 		res = read(s->fd, s->inbuf+4, dlen+4);