diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-01-07 20:14:25 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-01-07 20:14:25 +0000 |
| commit | b2ffcef3b9eba15cb7756958a84c7d83a8d1d2bc (patch) | |
| tree | 2c0fdce55c7ed77ab4289aaf9813aa9cb13a9d7d | |
| parent | 475c3299e7cb21a0c739ceafb964a9aa5eab7dd9 (diff) | |
fixes crash in "scheduled_destroy" in chan_iax
A signed short was used to represent a callnumber. This is makes
it possible to attempt to access the iaxs array with a negative
index.
(closes issue #16565)
Reported by: jensvb
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@238411 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_iax2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 7d321f45d..ac58c7703 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1507,7 +1507,7 @@ retry: static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { |