[Pkg-voip-commits] r8796 - /asterisk/branches/lenny/debian/patches/AST-2011-002

[tzafrir at alioth.debian.org]

Author: tzafrir
Date: Mon Feb 21 21:20:31 2011
New Revision: 8796

URL: http://svn.debian.org/wsvn/pkg-voip/?sc=1&rev=8796
Log:
AST-2011-002: Upstream 1.4 patch

Added:
    asterisk/branches/lenny/debian/patches/AST-2011-002

Added: asterisk/branches/lenny/debian/patches/AST-2011-002
URL: http://svn.debian.org/wsvn/pkg-voip/asterisk/branches/lenny/debian/patches/AST-2011-002?rev=8796&op=file
==============================================================================
--- asterisk/branches/lenny/debian/patches/AST-2011-002 (added)
+++ asterisk/branches/lenny/debian/patches/AST-2011-002 Mon Feb 21 21:20:31 2011
@@ -1,0 +1,108 @@
+From 5a77208dfcc3ebdd436b0442ffae5a1e253cb35e Mon Sep 17 00:00:00 2001
+From: Leif Madsen <lmadsen at digium.com>
+Date: Mon, 21 Feb 2011 18:33:41 +0000
+Subject: [PATCH] Merge changes related to AST-2011-002 and FAX-281.
+
+Origin: http://svnview.digium.com/svn/asterisk?view=rev&rev=308506
+---
+ main/udptl.c |   49 +++++++++++++++++++++++--------------------------
+ 1 files changed, 23 insertions(+), 26 deletions(-)
+
+diff --git a/main/udptl.c b/main/udptl.c
+index 76b4a14..77946f0 100644
+--- a/main/udptl.c
++++ b/main/udptl.c
+@@ -175,37 +175,31 @@ static int decode_length(uint8_t *buf, int limit, int *len, int *pvalue)
+ 	}
+ 	*pvalue = (buf[*len] & 0x3F) << 14;
+ 	(*len)++;
+-	/* Indicate we have a fragment */
++	/* We have a fragment.  Currently we don't process fragments. */
++	if (option_debug) {
++		ast_log(LOG_DEBUG, "UDPTL packet with length greater than 16K received, decoding will fail\n");
++	}
+ 	return 1;
+ }
+ /*- End of function --------------------------------------------------------*/
+ 
+ static int decode_open_type(uint8_t *buf, int limit, int *len, const uint8_t **p_object, int *p_num_octets)
+ {
+-	int octet_cnt;
+-	int octet_idx;
+-	int stat;
+-	int i;
+-	const uint8_t **pbuf;
++	int octet_cnt = 0;
+ 
+-	for (octet_idx = 0, *p_num_octets = 0; ; octet_idx += octet_cnt) {
+-		if ((stat = decode_length(buf, limit, len, &octet_cnt)) < 0)
+-			return -1;
+-		if (octet_cnt > 0) {
+-			*p_num_octets += octet_cnt;
++	if (decode_length(buf, limit, len, &octet_cnt) != 0)
++		return -1;
+ 
+-			pbuf = &p_object[octet_idx];
+-			i = 0;
+-			/* Make sure the buffer contains at least the number of bits requested */
+-			if ((*len + octet_cnt) > limit)
+-				return -1;
++	if (octet_cnt > 0) {
++		/* Make sure the buffer contains at least the number of bits requested */
++		if ((*len + octet_cnt) > limit)
++			return -1;
+ 
+-			*pbuf = &buf[*len];
+-			*len += octet_cnt;
+-		}
+-		if (stat == 0)
+-			break;
++		*p_num_octets = octet_cnt;
++		*p_object = &buf[*len];
++		*len += octet_cnt;
+ 	}
++
+ 	return 0;
+ }
+ /*- End of function --------------------------------------------------------*/
+@@ -290,8 +284,8 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, int len)
+ 	const uint8_t *data;
+ 	int ifp_len;
+ 	int repaired[16];
+-	const uint8_t *bufs[16];
+-	int lengths[16];
++	const uint8_t *bufs[ARRAY_LEN(s->f) - 1];
++	int lengths[ARRAY_LEN(s->f) - 1];
+ 	int span;
+ 	int entries;
+ 	int ifp_no;
+@@ -321,13 +315,13 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, int len)
+ 			do {
+ 				if ((stat2 = decode_length(buf, len, &ptr, &count)) < 0)
+ 					return -1;
+-				for (i = 0; i < count; i++) {
++				for (i = 0; i < count && total_count + i < ARRAY_LEN(bufs); i++) {
+ 					if ((stat = decode_open_type(buf, len, &ptr, &bufs[total_count + i], &lengths[total_count + i])) != 0)
+ 						return -1;
+ 				}
+-				total_count += count;
++				total_count += i;
+ 			}
+-			while (stat2 > 0);
++			while (stat2 > 0 && total_count < ARRAY_LEN(bufs));
+ 			/* Step through in reverse order, so we go oldest to newest */
+ 			for (i = total_count; i > 0; i--) {
+ 				if (seq_no - i >= s->rx_seq_no) {
+@@ -390,6 +384,9 @@ static int udptl_rx_packet(struct ast_udptl *s, uint8_t *buf, int len)
+ 		if (ptr + 1 > len)
+ 			return -1;
+ 		entries = buf[ptr++];
++		if (entries > MAX_FEC_ENTRIES) {
++			return -1;
++		}
+ 		s->rx[x].fec_entries = entries;
+ 
+ 		/* Decode the elements */
+-- 
+1.7.2.3
+