From c2dd998774578b04561c92e90676245f721f128c Mon Sep 17 00:00:00 2001
From: dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b>
Date: Tue, 2 Feb 2010 22:29:37 +0000
Subject: Merged revisions 244443 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/trunk

........
  r244443 | dvossel | 2010-02-02 16:27:23 -0600 (Tue, 02 Feb 2010) | 18 lines

  fixes crash during T.38 negotiation caused by invalid or missing FaxMaxDatagram field

  AST-2010-001

  (closes issue #16634)
  Reported by: krn

  (closes issue #16724)
  Reported by: barthpbx

  (closes issue #16517)
  Reported by: bklang

  (closes issue #16485)
  Reported by: elsto
........


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@244445 f38db490-d61c-443f-a65b-d21fe96a405b
---
 main/udptl.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

(limited to 'main/udptl.c')

diff --git a/main/udptl.c b/main/udptl.c
index 16eba8cc3..c715387c0 100644
--- a/main/udptl.c
+++ b/main/udptl.c
@@ -91,6 +91,8 @@ static int udptlfecspan;
 static int use_even_ports;
 
 #define LOCAL_FAX_MAX_DATAGRAM      1400
+#define DEFAULT_FAX_MAX_DATAGRAM    400
+#define FAX_MAX_DATAGRAM_LIMIT      1400
 #define MAX_FEC_ENTRIES             5
 #define MAX_FEC_SPAN                5
 
@@ -861,9 +863,13 @@ void ast_udptl_set_error_correction_scheme(struct ast_udptl *udptl, enum ast_t38
 
 void ast_udptl_set_local_max_ifp(struct ast_udptl *udptl, unsigned int max_ifp)
 {
-	udptl->local_max_ifp = max_ifp;
-	/* reset calculated values so they'll be computed again */
-	udptl->local_max_datagram = -1;
+	/* make sure max_ifp is a positive value since a cast will take place when
+	 * when setting local_max_ifp */
+	if ((signed int) max_ifp > 0) {
+		udptl->local_max_ifp = max_ifp;
+		/* reset calculated values so they'll be computed again */
+		udptl->local_max_datagram = -1;
+	}
 }
 
 unsigned int ast_udptl_get_local_max_datagram(struct ast_udptl *udptl)
@@ -871,18 +877,30 @@ unsigned int ast_udptl_get_local_max_datagram(struct ast_udptl *udptl)
 	if (udptl->local_max_datagram == -1) {
 		calculate_local_max_datagram(udptl);
 	}
+
+	/* this function expects a unsigned value in return. */
+	if (udptl->local_max_datagram < 0) {
+		return 0;
+	}
 	return udptl->local_max_datagram;
 }
 
 void ast_udptl_set_far_max_datagram(struct ast_udptl *udptl, unsigned int max_datagram)
 {
-	udptl->far_max_datagram = max_datagram;
+	if (!max_datagram || (max_datagram > FAX_MAX_DATAGRAM_LIMIT)) {
+		udptl->far_max_datagram = DEFAULT_FAX_MAX_DATAGRAM;
+	} else {
+		udptl->far_max_datagram = max_datagram;
+	}
 	/* reset calculated values so they'll be computed again */
 	udptl->far_max_ifp = -1;
 }
 
 unsigned int ast_udptl_get_far_max_datagram(const struct ast_udptl *udptl)
 {
+	if (udptl->far_max_datagram < 0) {
+		return 0;
+	}
 	return udptl->far_max_datagram;
 }
 
@@ -891,6 +909,10 @@ unsigned int ast_udptl_get_far_max_ifp(struct ast_udptl *udptl)
 	if (udptl->far_max_ifp == -1) {
 		calculate_far_max_ifp(udptl);
 	}
+
+	if (udptl->far_max_ifp < 0) {
+		return 0;
+	}
 	return udptl->far_max_ifp;
 }
 
@@ -1040,7 +1062,11 @@ int ast_udptl_write(struct ast_udptl *s, struct ast_frame *f)
 	unsigned int seq;
 	unsigned int len = f->datalen;
 	int res;
-	uint8_t buf[s->far_max_datagram];
+	/* if no max datagram size is provided, use default value */
+	const int bufsize = (s->far_max_datagram > 0) ? s->far_max_datagram : DEFAULT_FAX_MAX_DATAGRAM;
+	uint8_t buf[bufsize];
+
+	memset(buf, 0, sizeof(buf));
 
 	/* If we have no peer, return immediately */	
 	if (s->them.sin_addr.s_addr == INADDR_ANY)
-- 
cgit v1.2.3