[asterisk-commits] dvossel: branch 1.6.0 r238441 - in /branches/1.6.0: ./ channels/chan_iax2.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Thu Jan  7 14:22:50 2010
New Revision: 238441

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=238441
Log:
Merged revisions 238412 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines
  
  Merged revisions 238411 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
    
    fixes crash in "scheduled_destroy" in chan_iax
    
    A signed short was used to represent a callnumber.  This is makes
    it possible to attempt to access the iaxs array with a negative
    index.
    
    (closes issue #16565)
    Reported by: jensvb
  ........
................

Modified:
    branches/1.6.0/   (props changed)
    branches/1.6.0/channels/chan_iax2.c

Propchange: branches/1.6.0/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.0/channels/chan_iax2.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.0/channels/chan_iax2.c?view=diff&rev=238441&r1=238440&r2=238441
==============================================================================
--- branches/1.6.0/channels/chan_iax2.c (original)
+++ branches/1.6.0/channels/chan_iax2.c Thu Jan  7 14:22:50 2010
@@ -1509,7 +1509,7 @@
 
 static int scheduled_destroy(const void *vid)
 {
-	short callno = PTR_TO_CALLNO(vid);
+	unsigned short callno = PTR_TO_CALLNO(vid);
 	ast_mutex_lock(&iaxsl[callno]);
 	if (iaxs[callno]) {
 		if (option_debug) {