[asterisk-commits] file: branch 1.4 r112125 - in /branches/1.4: include/asterisk/ main/

[SVN commits to the Asterisk project]

Author: file
Date: Tue Apr  1 11:45:14 2008
New Revision: 112125

URL: http://svn.digium.com/view/asterisk?view=rev&rev=112125
Log:
Ensure that we do not exceed the hold's maximum size with a single frame.
(closes issue #12047)
Reported by: fabianoheringer
Tested by: fabianoheringer

Modified:
    branches/1.4/include/asterisk/slinfactory.h
    branches/1.4/main/slinfactory.c

Modified: branches/1.4/include/asterisk/slinfactory.h
URL: http://svn.digium.com/view/asterisk/branches/1.4/include/asterisk/slinfactory.h?view=diff&rev=112125&r1=112124&r2=112125
==============================================================================
--- branches/1.4/include/asterisk/slinfactory.h (original)
+++ branches/1.4/include/asterisk/slinfactory.h Tue Apr  1 11:45:14 2008
@@ -31,10 +31,12 @@
 extern "C" {
 #endif
 
+#define AST_SLINFACTORY_MAX_HOLD 1280
+
 struct ast_slinfactory {
 	AST_LIST_HEAD_NOLOCK(, ast_frame) queue;
 	struct ast_trans_pvt *trans;
-	short hold[1280];
+	short hold[AST_SLINFACTORY_MAX_HOLD];
 	short *offset;
 	size_t holdlen;			/*!< in samples */
 	unsigned int size;		/*!< in samples */

Modified: branches/1.4/main/slinfactory.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/main/slinfactory.c?view=diff&rev=112125&r1=112124&r2=112125
==============================================================================
--- branches/1.4/main/slinfactory.c (original)
+++ branches/1.4/main/slinfactory.c Tue Apr  1 11:45:14 2008
@@ -137,6 +137,9 @@
 				memcpy(offset, frame_data, ineed * sizeof(*offset));
 				sofar += ineed;
 				frame_data += ineed;
+				if (remain > (AST_SLINFACTORY_MAX_HOLD - sf->holdlen)) {
+					remain = AST_SLINFACTORY_MAX_HOLD - sf->holdlen;
+				}
 				memcpy(sf->hold, frame_data, remain * sizeof(*offset));
 				sf->holdlen = remain;
 			}