[svn-commits] lmadsen: tag 1.4.40 r308577 - in /tags/1.4.40: ./ main/

[SVN commits to the Digium repositories]

Author: lmadsen
Date: Tue Feb 22 16:49:28 2011
New Revision: 308577

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=308577
Log:
Update .version, ChangeLog, and remove old summary files.
Mad shout outs to russellb and funky bunch.

Removed:
    tags/1.4.40/asterisk-1.4.40-rc3-summary.html
    tags/1.4.40/asterisk-1.4.40-rc3-summary.txt
Modified:
    tags/1.4.40/.version
    tags/1.4.40/ChangeLog
    tags/1.4.40/main/udptl.c

Modified: tags/1.4.40/.version
URL: http://svnview.digium.com/svn/asterisk/tags/1.4.40/.version?view=diff&rev=308577&r1=308576&r2=308577
==============================================================================
--- tags/1.4.40/.version (original)
+++ tags/1.4.40/.version Tue Feb 22 16:49:28 2011
@@ -1,1 +1,1 @@
-1.4.40-rc3
+1.4.40

Modified: tags/1.4.40/ChangeLog
URL: http://svnview.digium.com/svn/asterisk/tags/1.4.40/ChangeLog?view=diff&rev=308577&r1=308576&r2=308577
==============================================================================
--- tags/1.4.40/ChangeLog (original)
+++ tags/1.4.40/ChangeLog Tue Feb 22 16:49:28 2011
@@ -1,3 +1,9 @@
+2011-02-22  Leif Madsen <lmadsen at digium.com>
+
+	* Asterisk 1.4.40 Released.
+
+	* Merged changes related to AST-2011-002
+
 2011-02-16  Leif Madsen <lmadsen at digium.com>
 
 	* Asterisk 1.4.40-rc3 Released.

Modified: tags/1.4.40/main/udptl.c
URL: http://svnview.digium.com/svn/asterisk/tags/1.4.40/main/udptl.c?view=diff&rev=308577&r1=308576&r2=308577
==============================================================================
--- tags/1.4.40/main/udptl.c (original)
+++ tags/1.4.40/main/udptl.c Tue Feb 22 16:49:28 2011
@@ -175,37 +175,31 @@
 	}
 	*pvalue = (buf[*len] & 0x3F) << 14;
 	(*len)++;
-	/* Indicate we have a fragment */
+	/* We have a fragment.  Currently we don't process fragments. */
+	if (option_debug) {
+		ast_log(LOG_DEBUG, "UDPTL packet with length greater than 16K received, decoding will fail\n");
+	}
 	return 1;
 }
 /*- End of function --------------------------------------------------------*/
 
 static int decode_open_type(uint8_t *buf, int limit, int *len, const uint8_t **p_object, int *p_num_octets)
 {
-	int octet_cnt;
-	int octet_idx;
-	int stat;
-	int i;
-	const uint8_t **pbuf;
-
-	for (octet_idx = 0, *p_num_octets = 0; ; octet_idx += octet_cnt) {
-		if ((stat = decode_length(buf, limit, len, &octet_cnt)) < 0)
+	int octet_cnt = 0;
+
+	if (decode_length(buf, limit, len, &octet_cnt) != 0)
+		return -1;
+
+	if (octet_cnt > 0) {
+		/* Make sure the buffer contains at least the number of bits requested */
+		if ((*len + octet_cnt) > limit)
 			return -1;
-		if (octet_cnt > 0) {
-			*p_num_octets += octet_cnt;
-
-			pbuf = &p_object[octet_idx];
-			i = 0;
-			/* Make sure the buffer contains at least the number of bits requested */
-			if ((*len + octet_cnt) > limit)
-				return -1;
-
-			*pbuf = &buf[*len];
-			*len += octet_cnt;
-		}
-		if (stat == 0)
-			break;
-	}
+
+		*p_num_octets = octet_cnt;
+		*p_object = &buf[*len];
+		*len += octet_cnt;
+	}
+
 	return 0;
 }
 /*- End of function --------------------------------------------------------*/
@@ -290,8 +284,8 @@
 	const uint8_t *data;
 	int ifp_len;
 	int repaired[16];
-	const uint8_t *bufs[16];
-	int lengths[16];
+	const uint8_t *bufs[ARRAY_LEN(s->f) - 1];
+	int lengths[ARRAY_LEN(s->f) - 1];
 	int span;
 	int entries;
 	int ifp_no;
@@ -321,13 +315,13 @@
 			do {
 				if ((stat2 = decode_length(buf, len, &ptr, &count)) < 0)
 					return -1;
-				for (i = 0; i < count; i++) {
+				for (i = 0; i < count && total_count + i < ARRAY_LEN(bufs); i++) {
 					if ((stat = decode_open_type(buf, len, &ptr, &bufs[total_count + i], &lengths[total_count + i])) != 0)
 						return -1;
 				}
-				total_count += count;
-			}
-			while (stat2 > 0);
+				total_count += i;
+			}
+			while (stat2 > 0 && total_count < ARRAY_LEN(bufs));
 			/* Step through in reverse order, so we go oldest to newest */
 			for (i = total_count; i > 0; i--) {
 				if (seq_no - i >= s->rx_seq_no) {
@@ -390,6 +384,9 @@
 		if (ptr + 1 > len)
 			return -1;
 		entries = buf[ptr++];
+		if (entries > MAX_FEC_ENTRIES) {
+			return -1;
+		}
 		s->rx[x].fec_entries = entries;
 
 		/* Decode the elements */