diff options
| author | Russell Bryant <russell@russellbryant.com> | 2007-07-17 20:49:09 +0000 |
|---|---|---|
| committer | Russell Bryant <russell@russellbryant.com> | 2007-07-17 20:49:09 +0000 |
| commit | b5ff588044aae1b28fd7fd8b488ec91c684baf13 (patch) | |
| tree | 800990dbdc005447ca001a29a8d86e51833d3eca /channels/chan_iax2.c | |
| parent | 54bd38f1ce25c173b4e0a937c8e18e5df5c6bb0a (diff) | |
Merged revisions 75445 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
................
r75445 | russell | 2007-07-17 15:48:21 -0500 (Tue, 17 Jul 2007) | 13 lines
Merged revisions 75444 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2
........
r75444 | russell | 2007-07-17 15:45:27 -0500 (Tue, 17 Jul 2007) | 5 lines
Ensure that when encoding the contents of an ast_frame into an iax_frame, that
the size of the destination buffer is known in the iax_frame so that code
won't write past the end of the allocated buffer when sending outgoing frames.
(ASA-2007-014)
........
................
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@75446 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels/chan_iax2.c')
| -rw-r--r-- | channels/chan_iax2.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index d9bd552a1..2ed8a3692 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1206,10 +1206,10 @@ static struct iax_frame *iaxfrdup2(struct iax_frame *fr) { struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable); if (new) { - size_t mallocd_datalen = new->mallocd_datalen; + size_t afdatalen = new->afdatalen; memcpy(new, fr, sizeof(*new)); iax_frame_wrap(new, &fr->af); - new->mallocd_datalen = mallocd_datalen; + new->afdatalen = afdatalen; new->data = NULL; new->datalen = 0; new->direction = DIRECTION_INGRESS; @@ -4045,7 +4045,9 @@ static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned in int sendmini=0; unsigned int lastsent; unsigned int fts; - + + frb.fr2.afdatalen = sizeof(frb.buffer); + if (!pvt) { ast_log(LOG_WARNING, "No private structure for packet?\n"); return -1; @@ -6847,6 +6849,7 @@ static int socket_process(struct iax2_thread *thread) /* allocate an iax_frame with 4096 bytes of data buffer */ fr = alloca(sizeof(*fr) + 4096); fr->callno = 0; + fr->afdatalen = 4096; /* From alloca() above */ /* Copy frequently used parameters to the stack */ res = thread->buf_len; |