Add test for negative offsets in cid data to prevent infinite loops.

git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@63750 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 6 insertions, 0 deletions

diff --git a/main/callerid.c b/main/callerid.c
index 9f42ccf1f..901137348 100644
--- a/main/callerid.c
+++ b/main/callerid.c
@@ -660,6 +660,12 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
 						default:
 							ast_log(LOG_NOTICE, "Unknown IE %d\n", cid->rawdata[x-1]);
 						}
+						if(0 > cid->rawdata[x]){	/* Negative offset in the CID Spill */
+							ast_log(LOG_NOTICE, "IE %d has bad field length of %d at offset %d\n", cid->rawdata[x-1], cid->rawdata[x], x);
+							/* Try again */
+							cid->sawflag = 0;
+							break; 	/* Exit the loop */
+						}
 						x += cid->rawdata[x];
 						x++;
 					}