[svn-commits] qwell: trunk r48871 - in /trunk: ./ channels/chan_skinny.c

[svn-commits at lists.digium.com]

Author: qwell
Date: Fri Dec 22 14:43:38 2006
New Revision: 48871

URL: http://svn.digium.com/view/asterisk?view=rev&rev=48871
Log:
Merged revisions 48870 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r48870 | qwell | 2006-12-22 14:43:05 -0600 (Fri, 22 Dec 2006) | 2 lines

Fix for issue 7774 - patch by alamantia

........

Modified:
    trunk/   (props changed)
    trunk/channels/chan_skinny.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: trunk/channels/chan_skinny.c
URL: http://svn.digium.com/view/asterisk/trunk/channels/chan_skinny.c?view=diff&rev=48871&r1=48870&r2=48871
==============================================================================
--- trunk/channels/chan_skinny.c (original)
+++ trunk/channels/chan_skinny.c Fri Dec 22 14:43:38 2006
@@ -1388,14 +1388,17 @@
 	int res = 0;
 	ast_mutex_lock(&s->lock);
 
-#if 0
 	if (skinnydebug)
-		ast_verbose("writing packet type %04X (%d bytes) to socket %d\n", letohl(req->e), letohl(req->len)+8, s->fd);
-#endif
+		ast_log(LOG_VERBOSE, "writing packet type %04X (%d bytes) to socket %d\n", letohl(req->e), letohl(req->len)+8, s->fd);
+
+	if (letohl(req->len > SKINNY_MAX_PACKET) || letohl(req->len < 0) {
+		ast_log(LOG_WARNING, "transmit_response: the length of the request is out of bounds\n");
+		return -1;
+	}
 
 	memset(s->outbuf,0,sizeof(s->outbuf));
 	memcpy(s->outbuf, req, skinny_header_size);
-	memcpy(s->outbuf+skinny_header_size, &req->data, sizeof(union skinny_data));
+	memcpy(s->outbuf+skinny_header_size, &req->data, letohl(req->len));
 
 	res = write(s->fd, s->outbuf, letohl(req->len)+8);