[asterisk-commits] dvossel: trunk r245793 - in /trunk: ./ channels/chan_iax2.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Tue Feb  9 17:07:17 2010
New Revision: 245793

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=245793
Log:
Merged revisions 245792 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r245792 | dvossel | 2010-02-09 16:55:38 -0600 (Tue, 09 Feb 2010) | 12 lines
  
  Fixes iaxs and iaxsl size off by one issue.
  
  2^15 = 32768 which is the maximum allowed iax2 callnumber.
  Creating the iaxs and iaxsl array of size 32768 means the maximum
  callnumber is actually out of bounds.  This causes a nasty crash.
  
  (closes issue #15997)
  Reported by: exarv
  Patches:
        iax_fix.diff uploaded by dvossel (license 671)
........

Modified:
    trunk/   (props changed)
    trunk/channels/chan_iax2.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: trunk/channels/chan_iax2.c
URL: http://svnview.digium.com/svn/asterisk/trunk/channels/chan_iax2.c?view=diff&rev=245793&r1=245792&r2=245793
==============================================================================
--- trunk/channels/chan_iax2.c (original)
+++ trunk/channels/chan_iax2.c Tue Feb  9 17:07:17 2010
@@ -848,7 +848,7 @@
  *
  * \note Contents protected by the iaxsl[] locks
  */
-static AST_LIST_HEAD_NOLOCK(, iax_frame) frame_queue[IAX_MAX_CALLS];
+static AST_LIST_HEAD_NOLOCK(, iax_frame) frame_queue[IAX_MAX_CALLS + 1];
 
 static struct ast_taskprocessor *transmit_processor;
 
@@ -1049,7 +1049,7 @@
  * based on the local call number.  The local call number is used as the
  * index into the array where the associated pvt structure is stored.
  */
-static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS];
+static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS + 1];
 
 /*!
  * \brief Another container of iax2_pvt structures