diff options
author | David Vossel <dvossel@digium.com> | 2010-01-07 20:15:27 +0000 |
---|---|---|
committer | David Vossel <dvossel@digium.com> | 2010-01-07 20:15:27 +0000 |
commit | c8bb5daf1e3143fc76438f5125a18a12f4fa5050 (patch) | |
tree | e6a54ce8380b076023f16392b29ec86ccb81b792 /channels | |
parent | 131a31245eedf3fc3faaff6e942b9d0f2f554086 (diff) |
Merged revisions 238411 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
fixes crash in "scheduled_destroy" in chan_iax
A signed short was used to represent a callnumber. This is makes
it possible to attempt to access the iaxs array with a negative
index.
(closes issue #16565)
Reported by: jensvb
........
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@238412 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels')
-rw-r--r-- | channels/chan_iax2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index ce32bbf0f..76abb11a7 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1700,7 +1700,7 @@ static void iax2_frame_free(struct iax_frame *fr) static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { |