diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-01-07 20:17:48 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-01-07 20:17:48 +0000 |
| commit | 3aa0d34aec7881631d71e6552dcac96bb6a33a7f (patch) | |
| tree | 50f704283f88a444c07b69b4c82f710117fb8278 /channels/chan_iax2.c | |
| parent | 958f18af9d4d0eba87488fe8909da06869abc043 (diff) | |
Merged revisions 238412 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk
................
r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines
Merged revisions 238411 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
fixes crash in "scheduled_destroy" in chan_iax
A signed short was used to represent a callnumber. This is makes
it possible to attempt to access the iaxs array with a negative
index.
(closes issue #16565)
Reported by: jensvb
........
................
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@238416 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels/chan_iax2.c')
| -rw-r--r-- | channels/chan_iax2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index b50c6ecbb..ef17173e5 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1656,7 +1656,7 @@ static void iax2_frame_free(struct iax_frame *fr) static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { |