[asterisk-commits] qwell: branch 1.4 r48870 - /branches/1.4/channels/chan_skinny.c

[asterisk-commits at lists.digium.com]

Author: qwell
Date: Fri Dec 22 14:43:05 2006
New Revision: 48870

URL: http://svn.digium.com/view/asterisk?view=rev&rev=48870
Log:
Fix for issue 7774 - patch by alamantia

Modified:
    branches/1.4/channels/chan_skinny.c

Modified: branches/1.4/channels/chan_skinny.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/channels/chan_skinny.c?view=diff&rev=48870&r1=48869&r2=48870
==============================================================================
--- branches/1.4/channels/chan_skinny.c (original)
+++ branches/1.4/channels/chan_skinny.c Fri Dec 22 14:43:05 2006
@@ -1392,14 +1392,17 @@
 	int res = 0;
 	ast_mutex_lock(&s->lock);
 
-#if 0
 	if (skinnydebug)
-		ast_verbose("writing packet type %04X (%d bytes) to socket %d\n", letohl(req->e), letohl(req->len)+8, s->fd);
-#endif
+		ast_log(LOG_VERBOSE, "writing packet type %04X (%d bytes) to socket %d\n", letohl(req->e), letohl(req->len)+8, s->fd);
+
+	if (letohl(req->len > SKINNY_MAX_PACKET) || letohl(req->len < 0) {
+		ast_log(LOG_WARNING, "transmit_response: the length of the request is out of bounds\n");
+		return -1;
+	}
 
 	memset(s->outbuf,0,sizeof(s->outbuf));
 	memcpy(s->outbuf, req, skinny_header_size);
-	memcpy(s->outbuf+skinny_header_size, &req->data, sizeof(union skinny_data));
+	memcpy(s->outbuf+skinny_header_size, &req->data, letohl(req->len));
 
 	res = write(s->fd, s->outbuf, letohl(req->len)+8);