[asterisk-commits] seanbright: branch group/1.6.1-maintenance r264422 - in /team/group/1.6.1-mai...

[SVN commits to the Asterisk project]

Author: seanbright
Date: Wed May 19 15:35:37 2010
New Revision: 264422

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=264422
Log:
Merged revisions 264379,264400 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

........
  r264379 | mnicholson | 2010-05-19 16:26:27 -0400 (Wed, 19 May 2010) | 4 lines
  
  Cast an unsigned int to a signed int when comparing it with 0.
  
  (AST-377)
........
  r264400 | dvossel | 2010-05-19 16:30:33 -0400 (Wed, 19 May 2010) | 11 lines
  
  fixes infinite loop during udptl.c's decode_open_type
  
  When decode_length returns the length there is a check to see if that
  length is negative, if so the decode loop breaks as this means the
  limit has been reached.  The problem here is that length is an
  unsigned int, so length can never be negative.  This resulted in
  an infinite loop.
  
  (issue #17352)
........

Modified:
    team/group/1.6.1-maintenance/   (props changed)
    team/group/1.6.1-maintenance/main/udptl.c

Propchange: team/group/1.6.1-maintenance/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: team/group/1.6.1-maintenance/main/udptl.c
URL: http://svnview.digium.com/svn/asterisk/team/group/1.6.1-maintenance/main/udptl.c?view=diff&rev=264422&r1=264421&r2=264422
==============================================================================
--- team/group/1.6.1-maintenance/main/udptl.c (original)
+++ team/group/1.6.1-maintenance/main/udptl.c Wed May 19 15:35:37 2010
@@ -226,8 +226,8 @@
 {
 	unsigned int octet_cnt;
 	unsigned int octet_idx;
-	unsigned int length;
 	unsigned int i;
+	int length; /* a negative length indicates the limit has been reached in decode_length. */
 	const uint8_t **pbuf;
 
 	for (octet_idx = 0, *p_num_octets = 0; ; octet_idx += octet_cnt) {
@@ -1097,7 +1097,7 @@
 	/* Cook up the UDPTL packet, with the relevant EC info. */
 	len = udptl_build_packet(s, buf, sizeof(buf), f->data.ptr, len);
 
-	if (len > 0 && s->them.sin_port && s->them.sin_addr.s_addr) {
+	if ((signed int) len > 0 && s->them.sin_port && s->them.sin_addr.s_addr) {
 		if ((res = sendto(s->fd, buf, len, 0, (struct sockaddr *) &s->them, sizeof(s->them))) < 0)
 			ast_log(LOG_NOTICE, "(%s): UDPTL Transmission error to %s:%d: %s\n",
 				LOG_TAG(s), ast_inet_ntoa(s->them.sin_addr), ntohs(s->them.sin_port), strerror(errno));