aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorkpfleming <kpfleming@f38db490-d61c-443f-a65b-d21fe96a405b>2006-06-06 15:38:44 +0000
committerkpfleming <kpfleming@f38db490-d61c-443f-a65b-d21fe96a405b>2006-06-06 15:38:44 +0000
commit6758935c4049539e9af7dfbdeb7a9ea84fa6978c (patch)
tree1656f37f6bcc07657874a7172728abfe1a1bc08a
parent1ed085172c57d4fa66467cae4c4b603cfe7bdc41 (diff)
correct yesterday's security fix so that it doesn't improperly reject valid video frames
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.0@32565 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r--channels/chan_iax2.c23
1 files changed, 13 insertions, 10 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index d55734293..a78823482 100644
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -5052,11 +5052,21 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr));
return 1;
}
- if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
+ if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+ if (res < sizeof(*vh)) {
+ ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a mini video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+ return 1;
+
+ }
/* This is a video frame, get call number */
fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1);
minivid = 1;
- } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+ } else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+ if (res < sizeof(*meta)) {
+ ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+ return 1;
+
+ }
/* This is a meta header */
switch(meta->metacmd) {
case IAX_META_TRUNK:
@@ -5149,14 +5159,7 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
}
return 1;
}
- /* if we got here and ->zeros contains zeros, this cannot be a valid
- miniframe or full frame but it wasn't a valid video frame or meta
- frame either, so we reject it
- */
- if (vh->zeros == 0) {
- ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
- return 1;
- }
+
#ifdef DEBUG_SUPPORT
if (iaxdebug)
iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr));