[asterisk-commits] mmichelson: trunk r103559 - /trunk/main/event.c

[SVN commits to the Asterisk project]

Author: mmichelson
Date: Tue Feb 12 18:55:09 2008
New Revision: 103559

URL: http://svn.digium.com/view/asterisk?view=rev&rev=103559
Log:
Fix a small logic error in ast_event_iterator_next. The previous logic allowed for the iterator
to indicate there was more data than there really was, causing the iterator read beyond the end
of the event structure. This led to invalid memory reads and potential crashes.


Modified:
    trunk/main/event.c

Modified: trunk/main/event.c
URL: http://svn.digium.com/view/asterisk/trunk/main/event.c?view=diff&rev=103559&r1=103558&r2=103559
==============================================================================
--- trunk/main/event.c (original)
+++ trunk/main/event.c Tue Feb 12 18:55:09 2008
@@ -383,7 +383,7 @@
 int ast_event_iterator_next(struct ast_event_iterator *iterator)
 {
 	iterator->ie = (struct ast_event_ie *) ( ((char *) iterator->ie) + sizeof(*iterator->ie) + ntohs(iterator->ie->ie_payload_len));
-	return ((iterator->event_len < (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
+	return ((iterator->event_len <= (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
 }
 
 enum ast_event_ie_type ast_event_iterator_get_ie_type(struct ast_event_iterator *iterator)