Merge "AST-2016-002 chan_sip.c: Fix retransmission timeout integer overflow."

1 files changed, 7 insertions, 0 deletions

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 10b0d23f2..aaf0b6d51 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -3970,6 +3970,13 @@ static int retrans_pkt(const void *data)
 			}
 
 			/* For non-invites, a maximum of 4 secs */
+			if (INT_MAX / pkt->timer_a < pkt->timer_t1) {
+				/*
+				 * Uh Oh, we will have an integer overflow.
+				 * Recalculate previous timeout time instead.
+				 */
+				pkt->timer_a = pkt->timer_a / 2;
+			}
 			siptimer_a = pkt->timer_t1 * pkt->timer_a;	/* Double each time */
 			if (pkt->method != SIP_INVITE && siptimer_a > 4000) {
 				siptimer_a = 4000;