diff options
| author | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-07-17 20:57:56 +0000 |
|---|---|---|
| committer | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-07-17 20:57:56 +0000 |
| commit | fd9478f65399a1e9331ed62ce97f973aa9b8de38 (patch) | |
| tree | f801143c5985c9548862944892a27739df1214a8 /channels | |
| parent | 4f8b388b2c5f3388e851eddd698d6752991d5df0 (diff) | |
Merged revisions 75449 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2
........
r75449 | russell | 2007-07-17 15:57:09 -0500 (Tue, 17 Jul 2007) | 3 lines
Properly check for the length in the skinny packet to prevent an invalid memcpy.
(ASA-2007-016)
........
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@75450 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_skinny.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c index 64b22080e..841778c6e 100644 --- a/channels/chan_skinny.c +++ b/channels/chan_skinny.c @@ -4286,7 +4286,7 @@ static int get_input(struct skinnysession *s) } dlen = letohl(*(int *)s->inbuf); - if (dlen < 0) { + if (dlen < 4) { ast_log(LOG_WARNING, "Skinny Client sent invalid data.\n"); ast_mutex_unlock(&s->lock); return -1; |