[libpri-commits] mattf: branch 1.4 r514 - in /branches/1.4: ./ q931.c

[SVN commits to the libpri project]

Author: mattf
Date: Fri Jan 11 10:34:44 2008
New Revision: 514

URL: http://svn.digium.com/view/libpri?view=rev&rev=514
Log:
Merged revisions 513 via svnmerge from 
https://origsvn.digium.com/svn/libpri/branches/1.2

........
r513 | mattf | 2008-01-11 10:33:52 -0600 (Fri, 11 Jan 2008) | 1 line

We should not be parsing further into the bearer capability IE if the length does not confirm that there actually is data present
........

Modified:
    branches/1.4/   (props changed)
    branches/1.4/q931.c

Propchange: branches/1.4/
------------------------------------------------------------------------------
--- branch-1.2-merged (original)
+++ branch-1.2-merged Fri Jan 11 10:34:44 2008
@@ -1,1 +1,1 @@
-/branches/1.2:1-332,385,389,415,423,426,445,460,478
+/branches/1.2:1-332,385,389,415,423,426,445,460,478,513

Modified: branches/1.4/q931.c
URL: http://svn.digium.com/view/libpri/branches/1.4/q931.c?view=diff&rev=514&r1=513&r2=514
==============================================================================
--- branches/1.4/q931.c (original)
+++ branches/1.4/q931.c Fri Jan 11 10:34:44 2008
@@ -591,8 +591,9 @@
 		pos++;
 	}
 	/* Stop here if no more */
-	if (pos >= len)
+	if (pos >= len - 2)
 		return;
+
 	if ((ie->data[1] & 0x7f) != TRANS_MODE_PACKET) {
 		/* Look for octets 5 and 5.a if present */
 		pri_message(pri, "%c                              Ext: %d  User information layer 1: %s (%d)\n", prefix, (ie->data[pos] >> 7), l12str(ie->data[pos] & 0x7f), ie->data[pos] & 0x7f);
@@ -619,6 +620,10 @@
 	call->transmoderate = ie->data[1] & 0x7f;
 	if (call->transmoderate == PRI_TRANS_CAP_AUDIO_4ESS)
 		call->transmoderate = PRI_TRANS_CAP_3_1K_AUDIO;
+
+	if (pos >= len - 2)
+		return 0;
+
 	if (call->transmoderate != TRANS_MODE_PACKET) {
 		call->userl1 = ie->data[pos] & 0x7f;
 		if (call->userl1 == PRI_LAYER_1_ITU_RATE_ADAPT) {