[asterisk-commits] file: branch 1.4 r101222 - /branches/1.4/main/slinfactory.c

[SVN commits to the Asterisk project]

Author: file
Date: Wed Jan 30 09:41:04 2008
New Revision: 101222

URL: http://svn.digium.com/view/asterisk?view=rev&rev=101222
Log:
Fix an issue where if a frame of higher sample size preceeded a frame of lower sample size and ast_slinfactory_read was called with a sample size of the combined values or higher a crash would happen.
(closes issue #11878)
Reported by: stuarth

Modified:
    branches/1.4/main/slinfactory.c

Modified: branches/1.4/main/slinfactory.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/main/slinfactory.c?view=diff&rev=101222&r1=101221&r2=101222
==============================================================================
--- branches/1.4/main/slinfactory.c (original)
+++ branches/1.4/main/slinfactory.c Wed Jan 30 09:41:04 2008
@@ -109,7 +109,7 @@
 		ineed = samples - sofar;
 
 		if (sf->holdlen) {
-			if ((sofar + sf->holdlen) <= ineed) {
+			if (sf->holdlen <= ineed) {
 				memcpy(offset, sf->hold, sf->holdlen * sizeof(*offset));
 				sofar += sf->holdlen;
 				offset += sf->holdlen;
@@ -128,7 +128,7 @@
 		if ((frame_ptr = AST_LIST_REMOVE_HEAD(&sf->queue, frame_list))) {
 			frame_data = frame_ptr->data;
 			
-			if ((sofar + frame_ptr->samples) <= ineed) {
+			if (frame_ptr->samples <= ineed) {
 				memcpy(offset, frame_data, frame_ptr->samples * sizeof(*offset));
 				sofar += frame_ptr->samples;
 				offset += frame_ptr->samples;