[svn-commits] trunk r32567 - in /trunk: ./ channels/chan_iax2.c

[svn-commits at lists.digium.com]

Author: kpfleming
Date: Tue Jun  6 10:48:42 2006
New Revision: 32567

URL: http://svn.digium.com/view/asterisk?rev=32567&view=rev
Log:
Merged revisions 32566 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.2

........
r32566 | kpfleming | 2006-06-06 10:48:00 -0500 (Tue, 06 Jun 2006) | 2 lines

clean up yesterday's security fix to not cause breakage when video mini frames are received

........

Modified:
    trunk/   (props changed)
    trunk/channels/chan_iax2.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.2-merged' - no diff available.

Modified: trunk/channels/chan_iax2.c
URL: http://svn.digium.com/view/asterisk/trunk/channels/chan_iax2.c?rev=32567&r1=32566&r2=32567&view=diff
==============================================================================
--- trunk/channels/chan_iax2.c (original)
+++ trunk/channels/chan_iax2.c Tue Jun  6 10:48:42 2006
@@ -6318,12 +6318,23 @@
 		ast_log(LOG_WARNING, "midget packet received (%d of %zd min)\n", res, sizeof(*mh));
 		return 1;
 	}
-	if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
+	if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+		if (res < sizeof(*vh)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* This is a video frame, get call number */
 		fr->callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1, fd);
 		minivid = 1;
-	} else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+	} else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
 		unsigned char metatype;
+
+		if (res < sizeof(*meta)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* This is a meta header */
 		switch(meta->metacmd) {
 		case IAX_META_TRUNK:
@@ -6445,20 +6456,16 @@
 		return 1;
 	}
 
-	/* if we got here and ->zeros contains zeros, this cannot be a valid
-	   miniframe or full frame but it wasn't a valid video frame or meta
-	   frame either, so we reject it
-	*/
-	if (vh->zeros == 0) {
-		ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-		return 1;
-	}
-
 #ifdef DEBUG_SUPPORT
 	if (iaxdebug && (res >= sizeof(*fh)))
 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(*fh));
 #endif
-	if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) {
+	if (ntohs(mh->callno) & IAX_FLAG_FULL) {
+		if (res < sizeof(*fh)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a full frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* Get the destination call number */
 		dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
 		/* Retrieve the type and subclass */