From 0a88b25c436d39e747d1a29748e3308fcb8d22d0 Mon Sep 17 00:00:00 2001 From: Tristan Matthews <tristan.matthews@savoirfairelinux.com> Date: Fri, 12 Jul 2013 10:20:29 -0400 Subject: [PATCH] * #27201: libiax: fix out of bounds memory access --- daemon/libs/iax2/iax2-parser.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/daemon/libs/iax2/iax2-parser.c b/daemon/libs/iax2/iax2-parser.c index 958380a409..0f538d8dca 100644 --- a/daemon/libs/iax2/iax2-parser.c +++ b/daemon/libs/iax2/iax2-parser.c @@ -369,7 +369,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s /* Don't mess with mini-frames */ return; } - if (fh->type > (int)sizeof(frames)/(int)sizeof(char *)) { + if (fh->type >= (int)sizeof(frames)/(int)sizeof(char *)) { snprintf(class2, (int)sizeof(class2), "(%d?)", fh->type); clas = class2; } else { @@ -386,7 +386,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s subclass = iaxs[(int)fh->csub]; } } else if (fh->type == AST_FRAME_CONTROL) { - if (fh->csub > (int)sizeof(cmds)/(int)sizeof(char *)) { + if (fh->csub >= (int)sizeof(cmds)/(int)sizeof(char *)) { snprintf(subclass2, (int)sizeof(subclass2), "(%d?)", fh->csub); subclass = subclass2; } else { -- GitLab