diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-02-09 22:55:38 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-02-09 22:55:38 +0000 |
| commit | 5b9518eb9536238010642cb3e1459fd7accaa044 (patch) | |
| tree | 6d9f5bdcb4d64eb21eced96094c6d3f668128c8b | |
| parent | 0efebb3662ec6b5065664d7c6a263c1599ac99bc (diff) | |
Fixes iaxs and iaxsl size off by one issue.
2^15 = 32768 which is the maximum allowed iax2 callnumber.
Creating the iaxs and iaxsl array of size 32768 means the maximum
callnumber is actually out of bounds. This causes a nasty crash.
(closes issue #15997)
Reported by: exarv
Patches:
iax_fix.diff uploaded by dvossel (license 671)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@245792 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_iax2.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index ac58c7703..f9f725511 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -912,8 +912,8 @@ static void __attribute__((format(printf, 1, 2))) jb_debug_output(const char *fm ast_verbose("%s", buf); } -/* XXX We probably should use a mutex when working with this XXX */ -static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS]; +/* IAX_MAX_CALLS + 1 to avoid the off by one error case when accessing the max call number */ +static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS + 1]; static ast_mutex_t iaxsl[ARRAY_LEN(iaxs)]; /*! @@ -936,7 +936,7 @@ static struct ao2_container *iax_transfercallno_pvts; /* Flag to use with trunk calls, keeping these calls high up. It halves our effective use but keeps the division between trunked and non-trunked better. */ -#define TRUNK_CALL_START ARRAY_LEN(iaxs) / 2 +#define TRUNK_CALL_START IAX_MAX_CALLS / 2 static int maxtrunkcall = TRUNK_CALL_START; static int maxnontrunkcall = 1; |