[asterisk-commits] russell: branch 1.4 r75445 - in /branches/1.4: ./ channels/

[SVN commits to the Asterisk project]

Author: russell
Date: Tue Jul 17 15:48:21 2007
New Revision: 75445

URL: http://svn.digium.com/view/asterisk?view=rev&rev=75445
Log:
Merged revisions 75444 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.2

........
r75444 | russell | 2007-07-17 15:45:27 -0500 (Tue, 17 Jul 2007) | 5 lines

Ensure that when encoding the contents of an ast_frame into an iax_frame, that
the size of the destination buffer is known in the iax_frame so that code
won't write past the end of the allocated buffer when sending outgoing frames.
(ASA-2007-014)

........

Modified:
    branches/1.4/   (props changed)
    branches/1.4/channels/chan_iax2.c
    branches/1.4/channels/iax2-parser.c
    branches/1.4/channels/iax2-parser.h

Propchange: branches/1.4/
------------------------------------------------------------------------------
Binary property 'branch-1.2-merged' - no diff available.

Modified: branches/1.4/channels/chan_iax2.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/channels/chan_iax2.c?view=diff&rev=75445&r1=75444&r2=75445
==============================================================================
--- branches/1.4/channels/chan_iax2.c (original)
+++ branches/1.4/channels/chan_iax2.c Tue Jul 17 15:48:21 2007
@@ -1121,10 +1121,10 @@
 {
 	struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable);
 	if (new) {
-		size_t mallocd_datalen = new->mallocd_datalen;
+		size_t afdatalen = new->afdatalen;
 		memcpy(new, fr, sizeof(*new));
 		iax_frame_wrap(new, &fr->af);
-		new->mallocd_datalen = mallocd_datalen;
+		new->afdatalen = afdatalen;
 		new->data = NULL;
 		new->datalen = 0;
 		new->direction = DIRECTION_INGRESS;
@@ -3877,7 +3877,9 @@
 	int sendmini=0;
 	unsigned int lastsent;
 	unsigned int fts;
-		
+
+	frb.fr2.afdatalen = sizeof(frb.buffer);
+
 	if (!pvt) {
 		ast_log(LOG_WARNING, "No private structure for packet?\n");
 		return -1;
@@ -6462,6 +6464,7 @@
 	/* allocate an iax_frame with 4096 bytes of data buffer */
 	fr = alloca(sizeof(*fr) + 4096);
 	fr->callno = 0;
+	fr->afdatalen = 4096; /* From alloca() above */
 
 	/* Copy frequently used parameters to the stack */
 	res = thread->buf_len;

Modified: branches/1.4/channels/iax2-parser.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/channels/iax2-parser.c?view=diff&rev=75445&r1=75444&r2=75445
==============================================================================
--- branches/1.4/channels/iax2-parser.c (original)
+++ branches/1.4/channels/iax2-parser.c Tue Jul 17 15:48:21 2007
@@ -931,13 +931,20 @@
 	fr->af.data = fr->afdata;
 	fr->af.len = f->len;
 	if (fr->af.datalen) {
+		size_t copy_len = fr->af.datalen;
+		if (copy_len > fr->afdatalen) {
+			ast_log(LOG_ERROR, "Losing frame data because destination buffer size '%d' bytes not big enough for '%d' bytes in the frame\n",
+				(int) fr->afdatalen, (int) fr->af.datalen);
+			copy_len = fr->afdatalen;
+		}
 #if __BYTE_ORDER == __LITTLE_ENDIAN
 		/* We need to byte-swap slinear samples from network byte order */
 		if ((fr->af.frametype == AST_FRAME_VOICE) && (fr->af.subclass == AST_FORMAT_SLINEAR)) {
-			ast_swapcopy_samples(fr->af.data, f->data, fr->af.samples);
+			/* 2 bytes / sample for SLINEAR */
+			ast_swapcopy_samples(fr->af.data, f->data, copy_len / 2);
 		} else
 #endif
-		memcpy(fr->af.data, f->data, fr->af.datalen);
+			memcpy(fr->af.data, f->data, copy_len);
 	}
 }
 
@@ -951,11 +958,11 @@
 	/* Attempt to get a frame from this thread's cache */
 	if ((iax_frames = ast_threadstorage_get(&frame_cache, sizeof(*iax_frames)))) {
 		AST_LIST_TRAVERSE_SAFE_BEGIN(iax_frames, fr, list) {
-			if (fr->mallocd_datalen >= datalen) {
-				size_t mallocd_datalen = fr->mallocd_datalen;
+			if (fr->afdatalen >= datalen) {
+				size_t afdatalen = fr->afdatalen;
 				AST_LIST_REMOVE_CURRENT(iax_frames, list);
 				memset(fr, 0, sizeof(*fr));
-				fr->mallocd_datalen = mallocd_datalen;
+				fr->afdatalen = afdatalen;
 				break;
 			}
 		}
@@ -964,12 +971,12 @@
 	if (!fr) {
 		if (!(fr = ast_calloc_cache(1, sizeof(*fr) + datalen)))
 			return NULL;
-		fr->mallocd_datalen = datalen;
+		fr->afdatalen = datalen;
 	}
 #else
 	if (!(fr = ast_calloc(1, sizeof(*fr) + datalen)))
 		return NULL;
-	fr->mallocd_datalen = datalen;
+	fr->afdatalen = datalen;
 #endif
 
 

Modified: branches/1.4/channels/iax2-parser.h
URL: http://svn.digium.com/view/asterisk/branches/1.4/channels/iax2-parser.h?view=diff&rev=75445&r1=75444&r2=75445
==============================================================================
--- branches/1.4/channels/iax2-parser.h (original)
+++ branches/1.4/channels/iax2-parser.h Tue Jul 17 15:48:21 2007
@@ -123,7 +123,7 @@
 	/* Actual, isolated frame header */
 	struct ast_frame af;
 	/*! Amount of space _allocated_ for data */
-	size_t mallocd_datalen;
+	size_t afdatalen;
 	unsigned char unused[AST_FRIENDLY_OFFSET];
 	unsigned char afdata[0];	/* Data for frame */
 };