diff options
author | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-07-17 20:45:27 +0000 |
---|---|---|
committer | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-07-17 20:45:27 +0000 |
commit | 4c9df6e31f645075f68f03772cd2349fd5f4de37 (patch) | |
tree | 11d41aff9ddb9fb9cf8bc1e4677fcbe655ff331a /channels/chan_iax2.c | |
parent | 63e63a46448834f35ed2b498b1f5e88f6a138b56 (diff) |
Ensure that when encoding the contents of an ast_frame into an iax_frame, that
the size of the destination buffer is known in the iax_frame so that code
won't write past the end of the allocated buffer when sending outgoing frames.
(ASA-2007-014)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.2@75444 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels/chan_iax2.c')
-rw-r--r-- | channels/chan_iax2.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 6643974d2..dacc20e17 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -4020,7 +4020,9 @@ static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned in int sendmini=0; unsigned int lastsent; unsigned int fts; - + + frb.fr2.afdatalen = sizeof(frb.buffer); + if (!pvt) { ast_log(LOG_WARNING, "No private structure for packet?\n"); return -1; @@ -6435,7 +6437,8 @@ static int socket_read(int *id, int fd, short events, void *cbdata) /* allocate an iax_frame with 4096 bytes of data buffer */ fr = alloca(sizeof(*fr) + 4096); fr->callno = 0; - + fr->afdatalen = 4096; /* From alloca() above */ + res = recvfrom(fd, buf, sizeof(buf), 0,(struct sockaddr *) &sin, &len); if (res < 0) { if (errno != ECONNREFUSED) |