From 0a88b25c436d39e747d1a29748e3308fcb8d22d0 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tristan.matthews@savoirfairelinux.com>
Date: Fri, 12 Jul 2013 10:20:29 -0400
Subject: [PATCH] * #27201: libiax: fix out of bounds memory access
---
daemon/libs/iax2/iax2-parser.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/daemon/libs/iax2/iax2-parser.c b/daemon/libs/iax2/iax2-parser.c
index 958380a409..0f538d8dca 100644
--- a/daemon/libs/iax2/iax2-parser.c
+++ b/daemon/libs/iax2/iax2-parser.c
@@ -369,7 +369,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s
/* Don't mess with mini-frames */
return;
}
- if (fh->type > (int)sizeof(frames)/(int)sizeof(char *)) {
+ if (fh->type >= (int)sizeof(frames)/(int)sizeof(char *)) {
snprintf(class2, (int)sizeof(class2), "(%d?)", fh->type);
clas = class2;
} else {
@@ -386,7 +386,7 @@ void iax_showframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, s
subclass = iaxs[(int)fh->csub];
}
} else if (fh->type == AST_FRAME_CONTROL) {
- if (fh->csub > (int)sizeof(cmds)/(int)sizeof(char *)) {
+ if (fh->csub >= (int)sizeof(cmds)/(int)sizeof(char *)) {
snprintf(subclass2, (int)sizeof(subclass2), "(%d?)", fh->csub);
subclass = subclass2;
} else {
--
GitLab