diff options
author | Kevin P. Fleming <kpfleming@digium.com> | 2006-06-06 15:48:42 +0000 |
---|---|---|
committer | Kevin P. Fleming <kpfleming@digium.com> | 2006-06-06 15:48:42 +0000 |
commit | 22b45aa4d3d8cd953b6f3f950f8225505c61dac2 (patch) | |
tree | 598e63dd5c7414700570527be098ff2460276eb1 /channels | |
parent | fa595a8d823b9eeb4e19cc36c2ce9e11ebfae1ce (diff) |
Merged revisions 32566 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2
........
r32566 | kpfleming | 2006-06-06 10:48:00 -0500 (Tue, 06 Jun 2006) | 2 lines
clean up yesterday's security fix to not cause breakage when video mini frames are received
........
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@32567 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels')
-rw-r--r-- | channels/chan_iax2.c | 31 |
1 files changed, 19 insertions, 12 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 7581db1e1..eca258018 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -6318,12 +6318,23 @@ static int socket_process(struct iax2_thread *thread) ast_log(LOG_WARNING, "midget packet received (%d of %zd min)\n", res, sizeof(*mh)); return 1; } - if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) { + if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) { + if (res < sizeof(*vh)) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + } + /* This is a video frame, get call number */ fr->callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1, fd); minivid = 1; - } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) { + } else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) { unsigned char metatype; + + if (res < sizeof(*meta)) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + } + /* This is a meta header */ switch(meta->metacmd) { case IAX_META_TRUNK: @@ -6445,20 +6456,16 @@ static int socket_process(struct iax2_thread *thread) return 1; } - /* if we got here and ->zeros contains zeros, this cannot be a valid - miniframe or full frame but it wasn't a valid video frame or meta - frame either, so we reject it - */ - if (vh->zeros == 0) { - ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); - return 1; - } - #ifdef DEBUG_SUPPORT if (iaxdebug && (res >= sizeof(*fh))) iax_showframe(NULL, fh, 1, &sin, res - sizeof(*fh)); #endif - if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) { + if (ntohs(mh->callno) & IAX_FLAG_FULL) { + if (res < sizeof(*fh)) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a full frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + } + /* Get the destination call number */ dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS; /* Retrieve the type and subclass */ |