[libpri-commits] trunk r315 - /trunk/q931.c

[libpri-commits at lists.digium.com]

Author: mattf
Date: Fri Feb 17 12:54:20 2006
New Revision: 315

URL: http://svn.digium.com/view/libpri?rev=315&view=rev
Log:
Fix for 6480 (crash when accepting calling_part_subaddress with nothing in it)

Modified:
    trunk/q931.c

Modified: trunk/q931.c
URL: http://svn.digium.com/view/libpri/trunk/q931.c?rev=315&r1=314&r2=315&view=diff
==============================================================================
--- trunk/q931.c (original)
+++ trunk/q931.c Fri Feb 17 12:54:20 2006
@@ -737,7 +737,7 @@
 
 static void q931_get_number(unsigned char *num, int maxlen, unsigned char *src, int len)
 {
-	if (len > maxlen - 1) {
+	if ((len < 0) || (len > maxlen - 1)) {
 		num[0] = 0;
 		return;
 	}
@@ -781,7 +781,7 @@
 static FUNC_DUMP(dump_calling_party_subaddr)
 {
 	unsigned char cnum[256];
-	q931_get_number(cnum, sizeof(cnum), ie->data + 2, len - 4);
+	q931_get_number(cnum, sizeof(cnum), ie->data + 1, len - 3);
 	pri_message(pri, "%c Calling Sub-Address (len=%2d) [ Ext: %d  Type: %s (%d) O: %d '%s' ]\n",
 		prefix, len, ie->data[0] >> 7,
 		subaddrtype2str((ie->data[0] & 0x70) >> 4), (ie->data[0] & 0x70) >> 4,
@@ -890,7 +890,7 @@
 static FUNC_RECV(receive_calling_party_subaddr)
 {
 	/* copy digits to call->callingsubaddr */
- 	q931_get_number((unsigned char *) call->callingsubaddr, sizeof(call->callingsubaddr), ie->data + 2, len - 4);
+ 	q931_get_number((unsigned char *) call->callingsubaddr, sizeof(call->callingsubaddr), ie->data + 1, len - 3);
 	return 0;
 }