[asterisk-commits] anthonyl: branch anthonyl/7774-branch r48120 - /team/anthonyl/7774-branch/cha...

[asterisk-commits at lists.digium.com]

Author: anthonyl
Date: Wed Nov 29 15:57:46 2006
New Revision: 48120

URL: http://svn.digium.com/view/asterisk?view=rev&rev=48120
Log:
made the memcpy safe, and added some length checking

Modified:
    team/anthonyl/7774-branch/channels/chan_skinny.c

Modified: team/anthonyl/7774-branch/channels/chan_skinny.c
URL: http://svn.digium.com/view/asterisk/team/anthonyl/7774-branch/channels/chan_skinny.c?view=diff&rev=48120&r1=48119&r2=48120
==============================================================================
--- team/anthonyl/7774-branch/channels/chan_skinny.c (original)
+++ team/anthonyl/7774-branch/channels/chan_skinny.c Wed Nov 29 15:57:46 2006
@@ -1393,9 +1393,14 @@
 		ast_verbose("writing packet type %04X (%d bytes) to socket %d\n", letohl(req->e), letohl(req->len)+8, s->fd);
 #endif
 
+	if ( letohl(req->len) < 0) {
+		ast_log(LOG_WARNING, "transmit_response: sent a bogus skinny request\n");
+		return -1;
+	}
+	
 	memset(s->outbuf,0,sizeof(s->outbuf));
 	memcpy(s->outbuf, req, skinny_header_size);
-	memcpy(s->outbuf+skinny_header_size, &req->data, sizeof(union skinny_data));
+	memcpy(s->outbuf+skinny_header_size, &req->data, letohl(req->len));
 
 	res = write(s->fd, s->outbuf, letohl(req->len)+8);