diff options
author | lmadsen <lmadsen@f38db490-d61c-443f-a65b-d21fe96a405b> | 2011-02-21 18:34:57 +0000 |
---|---|---|
committer | lmadsen <lmadsen@f38db490-d61c-443f-a65b-d21fe96a405b> | 2011-02-21 18:34:57 +0000 |
commit | 89bfd6f374fb34bfd9f9dae1a1081e12da42facd (patch) | |
tree | ac51c708e7167ab98e941870830b99409bfc810a | |
parent | c58caee48aa12499cb2959366e19b18c59d11daa (diff) |
Merge changes related to AST-2011-002 and FAX-281.
git-svn-id: http://svn.digium.com/svn/asterisk/tags/1.8.2.4@308508 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r-- | main/udptl.c | 48 |
1 files changed, 21 insertions, 27 deletions
diff --git a/main/udptl.c b/main/udptl.c index 100044919..a9319641c 100644 --- a/main/udptl.c +++ b/main/udptl.c @@ -218,38 +218,29 @@ static int decode_length(uint8_t *buf, unsigned int limit, unsigned int *len, un } *pvalue = (buf[*len] & 0x3F) << 14; (*len)++; - /* Indicate we have a fragment */ + /* We have a fragment. Currently we don't process fragments. */ + ast_debug(1, "UDPTL packet with length greater than 16K received, decoding will fail\n"); return 1; } /*- End of function --------------------------------------------------------*/ static int decode_open_type(uint8_t *buf, unsigned int limit, unsigned int *len, const uint8_t **p_object, unsigned int *p_num_octets) { - unsigned int octet_cnt; - unsigned int octet_idx; - unsigned int i; - int length; /* a negative length indicates the limit has been reached in decode_length. */ - const uint8_t **pbuf; + unsigned int octet_cnt = 0; - for (octet_idx = 0, *p_num_octets = 0; ; octet_idx += octet_cnt) { - octet_cnt = 0; - if ((length = decode_length(buf, limit, len, &octet_cnt)) < 0) - return -1; - if (octet_cnt > 0) { - *p_num_octets += octet_cnt; + if (decode_length(buf, limit, len, &octet_cnt) != 0) + return -1; - pbuf = &p_object[octet_idx]; - i = 0; - /* Make sure the buffer contains at least the number of bits requested */ - if ((*len + octet_cnt) > limit) - return -1; + if (octet_cnt > 0) { + /* Make sure the buffer contains at least the number of bits requested */ + if ((*len + octet_cnt) > limit) + return -1; - *pbuf = &buf[*len]; - *len += octet_cnt; - } - if (length == 0) - break; + *p_num_octets = octet_cnt; + *p_object = &buf[*len]; + *len += octet_cnt; } + return 0; } /*- End of function --------------------------------------------------------*/ @@ -336,8 +327,8 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, unsigned int len) const uint8_t *data; unsigned int ifp_len; int repaired[16]; - const uint8_t *bufs[16]; - unsigned int lengths[16]; + const uint8_t *bufs[ARRAY_LEN(s->f) - 1]; + unsigned int lengths[ARRAY_LEN(s->f) - 1]; int span; int entries; int ifp_no; @@ -367,13 +358,13 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, unsigned int len) do { if ((stat2 = decode_length(buf, len, &ptr, &count)) < 0) return -1; - for (i = 0; i < count; i++) { + for (i = 0; i < count && total_count + i < ARRAY_LEN(bufs); i++) { if ((stat1 = decode_open_type(buf, len, &ptr, &bufs[total_count + i], &lengths[total_count + i])) != 0) return -1; } - total_count += count; + total_count += i; } - while (stat2 > 0); + while (stat2 > 0 && total_count < ARRAY_LEN(bufs)); /* Step through in reverse order, so we go oldest to newest */ for (i = total_count; i > 0; i--) { if (seq_no - i >= s->rx_seq_no) { @@ -436,6 +427,9 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, unsigned int len) if (ptr + 1 > len) return -1; entries = buf[ptr++]; + if (entries > MAX_FEC_ENTRIES) { + return -1; + } s->rx[x].fec_entries = entries; /* Decode the elements */ |