automerge commit

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2-netsec@32595 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/callerid.c b/callerid.c
index a0937b24af16e53dd9383cd7e96a2b40f1e9e541..f709bd501796223874d06507470a5c887965d6f5 100644 (file)
--- a/callerid.c
+++ b/callerid.c
@@ -274,6 +274,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
                res = fsk_serie(&cid->fskd, buf, &mylen, &b);
                if (mylen < 0) {
                        ast_log(LOG_ERROR, "fsk_serie made mylen < 0 (%d)\n", mylen);
+                       free(obuf);
                        return -1;
                }
                buf += (olen - mylen);
@@ -307,6 +308,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
                        case 4: /* Retrieve message */
                                if (cid->pos >= 128) {
                                        ast_log(LOG_WARNING, "Caller ID too long???\n");
+                                       free(obuf);
                                        return -1;
                                }
                                cid->rawdata[cid->pos++] = b;
@@ -392,6 +394,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
                                        strcpy(cid->name, "");
                                        cid->flags |= CID_UNKNOWN_NAME;
                                }
+                               free(obuf);
                                return 1;
                                break;
                        default:

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index a7f0c23039b2ab4288ecff499e879268d0f7023f..9eeeb36345a58634c9deef755d20ab5f62a7e3fa 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -6327,12 +6327,23 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
                ast_log(LOG_WARNING, "midget packet received (%d of %zd min)\n", res, sizeof(*mh));
                return 1;
        }
-       if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
+       if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+               if (res < sizeof(*vh)) {
+                       ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+                       return 1;
+               }
+
                /* This is a video frame, get call number */
                fr->callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1, fd);
                minivid = 1;
-       } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+       } else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
                unsigned char metatype;
+
+               if (res < sizeof(*meta)) {
+                       ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+                       return 1;
+               }
+
                /* This is a meta header */
                switch(meta->metacmd) {
                case IAX_META_TRUNK:
@@ -6454,20 +6465,16 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
                return 1;
        }
 
-       /* if we got here and ->zeros contains zeros, this cannot be a valid
-          miniframe or full frame but it wasn't a valid video frame or meta
-          frame either, so we reject it
-       */
-       if (vh->zeros == 0) {
-               ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-               return 1;
-       }
-
 #ifdef DEBUG_SUPPORT
        if (iaxdebug && (res >= sizeof(*fh)))
                iax_showframe(NULL, fh, 1, &sin, res - sizeof(*fh));
 #endif
-       if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) {
+       if (ntohs(mh->callno) & IAX_FLAG_FULL) {
+               if (res < sizeof(*fh)) {
+                       ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a full frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+                       return 1;
+               }
+
                /* Get the destination call number */
                dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
                /* Retrieve the type and subclass */