diff options
| -rw-r--r-- | main/callerid.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/main/callerid.c b/main/callerid.c index 002666aa9..74b8d9200 100644 --- a/main/callerid.c +++ b/main/callerid.c @@ -636,6 +636,12 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int default: ast_log(LOG_NOTICE, "Unknown IE %d\n", cid->rawdata[x - 1]); } + if(0 > cid->rawdata[x]){ /* Negative offset in the CID Spill */ + ast_log(LOG_NOTICE, "IE %d has bad field length of %d at offset %d\n", cid->rawdata[x-1], cid->rawdata[x], x); + /* Try again */ + cid->sawflag = 0; + break; /* Exit the loop */ + } x += cid->rawdata[x]; x++; } |