diff options
| author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-11-25 21:40:28 +0000 |
|---|---|---|
| committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-11-25 21:40:28 +0000 |
| commit | 31c498d5dafb1f7935e19c7d5b589606aa1c41c9 (patch) | |
| tree | 6428fc1083b1957585960c5353f3133117992a89 | |
| parent | b4a7bb15ed240b0cd91e856b0ad876e95a4fab45 (diff) | |
Merged revisions 159245 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2
........
r159245 | tilghman | 2008-11-25 15:37:06 -0600 (Tue, 25 Nov 2008) | 7 lines
Regression fix for last security fix. Set the iseqno correctly.
(closes issue #13918)
Reported by: ffloimair
Patches:
20081119__bug13918.diff.txt uploaded by Corydon76 (license 14)
Tested by: ffloimair
........
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@159246 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_iax2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 6d9aa82f0..239aef1aa 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -3225,7 +3225,7 @@ struct parsed_dial_string { static int send_apathetic_reply(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int command, int ts, unsigned char seqno) { struct ast_iax2_full_hdr f = { .scallno = htons(0x8000 | callno), .dcallno = htons(dcallno), - .ts = htonl(ts), .iseqno = seqno, .oseqno = seqno, .type = AST_FRAME_IAX, + .ts = htonl(ts), .iseqno = seqno, .oseqno = 0, .type = AST_FRAME_IAX, .csub = compress_subclass(command) }; return sendto(defaultsockfd, &f, sizeof(f), 0, (struct sockaddr *)sin, sizeof(*sin)); @@ -7225,7 +7225,7 @@ static int socket_process(struct iax2_thread *thread) /* Deal with POKE/PONG without allocating a callno */ if (f.frametype == AST_FRAME_IAX && f.subclass == IAX_COMMAND_POKE) { /* Reply back with a PONG, but don't care about the result. */ - send_apathetic_reply(1, ntohs(fh->scallno), &sin, IAX_COMMAND_PONG, ntohs(fh->ts), fh->oseqno); + send_apathetic_reply(1, ntohs(fh->scallno), &sin, IAX_COMMAND_PONG, ntohs(fh->ts), fh->iseqno + 1); return 1; } else if (f.frametype == AST_FRAME_IAX && f.subclass == IAX_COMMAND_ACK && dcallno == 1) { /* Ignore */ |