From 91442293719fefd7639e06bc97a8e31212dd473c Mon Sep 17 00:00:00 2001 From: dvossel Date: Thu, 7 Jan 2010 20:22:50 +0000 Subject: Merged revisions 238412 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ................ r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines Merged revisions 238411 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines fixes crash in "scheduled_destroy" in chan_iax A signed short was used to represent a callnumber. This is makes it possible to attempt to access the iaxs array with a negative index. (closes issue #16565) Reported by: jensvb ........ ................ git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.0@238441 f38db490-d61c-443f-a65b-d21fe96a405b --- channels/chan_iax2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'channels/chan_iax2.c') diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index dcd4a17dd..d5429d7cf 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1509,7 +1509,7 @@ static void iax2_frame_free(struct iax_frame *fr) static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { -- cgit v1.2.3