[asterisk-commits] dvossel: trunk r238412 - in /trunk: ./ channels/chan_iax2.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Thu Jan  7 14:15:27 2010
New Revision: 238412

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=238412
Log:
Merged revisions 238411 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
  
  fixes crash in "scheduled_destroy" in chan_iax
  
  A signed short was used to represent a callnumber.  This is makes
  it possible to attempt to access the iaxs array with a negative
  index.
  
  (closes issue #16565)
  Reported by: jensvb
........

Modified:
    trunk/   (props changed)
    trunk/channels/chan_iax2.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: trunk/channels/chan_iax2.c
URL: http://svnview.digium.com/svn/asterisk/trunk/channels/chan_iax2.c?view=diff&rev=238412&r1=238411&r2=238412
==============================================================================
--- trunk/channels/chan_iax2.c (original)
+++ trunk/channels/chan_iax2.c Thu Jan  7 14:15:27 2010
@@ -1700,7 +1700,7 @@
 
 static int scheduled_destroy(const void *vid)
 {
-	short callno = PTR_TO_CALLNO(vid);
+	unsigned short callno = PTR_TO_CALLNO(vid);
 	ast_mutex_lock(&iaxsl[callno]);
 	if (iaxs[callno]) {
 		if (option_debug) {