From c8bb5daf1e3143fc76438f5125a18a12f4fa5050 Mon Sep 17 00:00:00 2001 From: David Vossel Date: Thu, 7 Jan 2010 20:15:27 +0000 Subject: Merged revisions 238411 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines fixes crash in "scheduled_destroy" in chan_iax A signed short was used to represent a callnumber. This is makes it possible to attempt to access the iaxs array with a negative index. (closes issue #16565) Reported by: jensvb ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@238412 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_iax2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'channels/chan_iax2.c') diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index ce32bbf0f..76abb11a7 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1700,7 +1700,7 @@ static void iax2_frame_free(struct iax_frame *fr) static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { -- cgit v1.2.3