Merged revisions 101222 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r101222 | file | 2008-01-30 11:41:04 -0400 (Wed, 30 Jan 2008) | 4 lines

Fix an issue where if a frame of higher sample size preceeded a frame of lower sample size and ast_slinfactory_read was called with a sample size of the combined values or higher a crash would happen.
(closes issue #11878)
Reported by: stuarth

........

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@101223 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/slinfactory.c b/main/slinfactory.c
index f8354603a052c971f7f52255cd670c539a22d6fc..fdcfa878fad47483e1e7865d7ab72144ebd6f5dc 100644 (file)
--- a/main/slinfactory.c
+++ b/main/slinfactory.c
@@ -109,7 +109,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
                ineed = samples - sofar;
 
                if (sf->holdlen) {
-                       if ((sofar + sf->holdlen) <= ineed) {
+                       if (sf->holdlen <= ineed) {
                                memcpy(offset, sf->hold, sf->holdlen * sizeof(*offset));
                                sofar += sf->holdlen;
                                offset += sf->holdlen;
@@ -128,7 +128,7 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
                if ((frame_ptr = AST_LIST_REMOVE_HEAD(&sf->queue, frame_list))) {
                        frame_data = frame_ptr->data;
                        
-                       if ((sofar + frame_ptr->samples) <= ineed) {
+                       if (frame_ptr->samples <= ineed) {
                                memcpy(offset, frame_data, frame_ptr->samples * sizeof(*offset));
                                sofar += frame_ptr->samples;
                                offset += frame_ptr->samples;