diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-05-19 20:30:33 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2010-05-19 20:30:33 +0000 |
| commit | 81dd162006103d71d36386b768747edc8a6b2c2a (patch) | |
| tree | 521cb52fe1b4958fd831dfd819a66d0e5a30c84f /main/udptl.c | |
| parent | f58e11eb39afa8cef0bd11e804f2c88f69cb321f (diff) | |
fixes infinite loop during udptl.c's decode_open_type
When decode_length returns the length there is a check to see if that
length is negative, if so the decode loop breaks as this means the
limit has been reached. The problem here is that length is an
unsigned int, so length can never be negative. This resulted in
an infinite loop.
(issue #17352)
git-svn-id: http://svn.digium.com/svn/asterisk/trunk@264400 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main/udptl.c')
| -rw-r--r-- | main/udptl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/main/udptl.c b/main/udptl.c index 0e88b2b4a..113a183c0 100644 --- a/main/udptl.c +++ b/main/udptl.c @@ -226,8 +226,8 @@ static int decode_open_type(uint8_t *buf, unsigned int limit, unsigned int *len, { unsigned int octet_cnt; unsigned int octet_idx; - unsigned int length; unsigned int i; + int length; /* a negative length indicates the limit has been reached in decode_length. */ const uint8_t **pbuf; for (octet_idx = 0, *p_num_octets = 0; ; octet_idx += octet_cnt) { |