From 0a88b25c436d39e747d1a29748e3308fcb8d22d0 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tristan.matthews@savoirfairelinux.com>
Date: Fri, 12 Jul 2013 10:20:29 -0400
Subject: [PATCH] * #27201: libiax: fix out of bounds memory access

---
 daemon/libs/iax2/iax2-parser.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/daemon/libs/iax2/iax2-parser.c b/daemon/libs/iax2/iax2-parser.c
index 958380a409..0f538d8dca 100644
--- a/daemon/libs/iax2/iax2-parser.c
+++ b/daemon/libs/iax2/iax2-parser.c
@@ -369,7 +369,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s
 		/* Don't mess with mini-frames */
 		return;
 	}
-	if (fh->type > (int)sizeof(frames)/(int)sizeof(char *)) {
+	if (fh->type >= (int)sizeof(frames)/(int)sizeof(char *)) {
 		snprintf(class2, (int)sizeof(class2), "(%d?)", fh->type);
 		clas = class2;
 	} else {
@@ -386,7 +386,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s
 			subclass = iaxs[(int)fh->csub];
 		}
 	} else if (fh->type == AST_FRAME_CONTROL) {
-		if (fh->csub > (int)sizeof(cmds)/(int)sizeof(char *)) {
+		if (fh->csub >= (int)sizeof(cmds)/(int)sizeof(char *)) {
 			snprintf(subclass2, (int)sizeof(subclass2), "(%d?)", fh->csub);
 			subclass = subclass2;
 		} else {
-- 
GitLab