correct yesterday's security fix so that it doesn't improperly reject valid video...

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.0@32565 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index d55734293b2197fc15c55824fb6c71038ac741cf..a788234821a56dfdc672d1c58e9cbf8579c76299 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -5052,11 +5052,21 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
                ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr));
                return 1;
        }
-       if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
+       if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+               if (res < sizeof(*vh)) {
+                       ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a mini video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+                       return 1;
+                       
+               }
                /* This is a video frame, get call number */
                fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1);
                minivid = 1;
-       } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+       } else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+               if (res < sizeof(*meta)) {
+                       ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+                       return 1;
+                       
+               }
                /* This is a meta header */
                switch(meta->metacmd) {
                case IAX_META_TRUNK:
@@ -5149,14 +5159,7 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
                }
                return 1;
        }
-       /* if we got here and ->zeros contains zeros, this cannot be a valid
-          miniframe or full frame but it wasn't a valid video frame or meta
-          frame either, so we reject it
-       */
-       if (vh->zeros == 0) {
-               ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-               return 1;
-       }
+
 #ifdef DEBUG_SUPPORT
        if (iaxdebug)
                iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr));