kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-06 12:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix an issue where if a frame of higher sample size preceeded a frame of lower sample size and ast_slinfactory_read was called with a sample size of the combined values or higher a crash would happen.

Browse Source 
(closes issue #11878)
Reported by: stuarth


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@101222 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Joshua Colp
2008-01-30 15:41:04 +00:00
parent ebbc70daab
commit 7b31f51cf9
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
main/slinfactory.c
View File

@@ -109,7 +109,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
ineed = samples - sofar; ineed = samples - sofar;
if (sf->holdlen) { if (sf->holdlen) {
if ((sofar + sf->holdlen) <= ineed) { if (sf->holdlen <= ineed) {
memcpy(offset, sf->hold, sf->holdlen * sizeof(*offset)); memcpy(offset, sf->hold, sf->holdlen * sizeof(*offset));
sofar += sf->holdlen; sofar += sf->holdlen;
offset += sf->holdlen; offset += sf->holdlen;
@@ -128,7 +128,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
if ((frame_ptr = AST_LIST_REMOVE_HEAD(&sf->queue, frame_list))) { if ((frame_ptr = AST_LIST_REMOVE_HEAD(&sf->queue, frame_list))) {
frame_data = frame_ptr->data; frame_data = frame_ptr->data;
if ((sofar + frame_ptr->samples) <= ineed) { if (frame_ptr->samples <= ineed) {
memcpy(offset, frame_data, frame_ptr->samples * sizeof(*offset)); memcpy(offset, frame_data, frame_ptr->samples * sizeof(*offset));
sofar += frame_ptr->samples; sofar += frame_ptr->samples;
offset += frame_ptr->samples; offset += frame_ptr->samples;