diff options
| author | file <file@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-30 15:41:04 +0000 |
|---|---|---|
| committer | file <file@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-30 15:41:04 +0000 |
| commit | f8911a209226f2ea06a0120db8dfd26c7e198253 (patch) | |
| tree | 620125cd2be4f7822bef83eebe93f84c02034af9 | |
| parent | e02fbff20dc8fbde9c51ca929570679f6d09dc5f (diff) | |
Fix an issue where if a frame of higher sample size preceeded a frame of lower sample size and ast_slinfactory_read was called with a sample size of the combined values or higher a crash would happen.
(closes issue #11878)
Reported by: stuarth
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@101222 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | main/slinfactory.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/main/slinfactory.c b/main/slinfactory.c index 03f6dcae8..df1af3738 100644 --- a/main/slinfactory.c +++ b/main/slinfactory.c @@ -109,7 +109,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples) ineed = samples - sofar; if (sf->holdlen) { - if ((sofar + sf->holdlen) <= ineed) { + if (sf->holdlen <= ineed) { memcpy(offset, sf->hold, sf->holdlen * sizeof(*offset)); sofar += sf->holdlen; offset += sf->holdlen; @@ -128,7 +128,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples) if ((frame_ptr = AST_LIST_REMOVE_HEAD(&sf->queue, frame_list))) { frame_data = frame_ptr->data; - if ((sofar + frame_ptr->samples) <= ineed) { + if (frame_ptr->samples <= ineed) { memcpy(offset, frame_data, frame_ptr->samples * sizeof(*offset)); sofar += frame_ptr->samples; offset += frame_ptr->samples; |