From: Jeff Peeler <jpeeler@digium.com>
Date: Tue, 26 Jan 2010 18:12:27 +0000 (+0000)
Subject: Merged revisions 243244 via svnmerge from
X-Git-Tag: 1.6.1.15-rc1~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=247ee74e7a2f4573b92d537ec487b3d42a86ef87;p=thirdparty%2Fasterisk.git

Merged revisions 243244 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

........
  r243244 | jpeeler | 2010-01-26 12:07:57 -0600 (Tue, 26 Jan 2010) | 12 lines

  Fix crash resulting from frames with invalid data pointers.

  In ast_frdup the frame data union does not get set to point to malloced memory
  if the datalen is zero, so make sure to handle the same case in ast_frisolate
  appropriately.

  (closes issue #16058)
  Reported by: atis
  Patches:
        bug16058-fix.patch uploaded by jpeeler (license 325)
  Tested by: atis
........


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@243246 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/frame.c b/main/frame.c
index 16f5d5a58c..b38f2df9ec 100644
--- a/main/frame.c
+++ b/main/frame.c
@@ -431,6 +431,11 @@ struct ast_frame *ast_frisolate(struct ast_frame *fr)
 	}
 	
 	if (!(fr->mallocd & AST_MALLOCD_DATA))  {
+		if (!fr->datalen) {
+			out->data.uint32 = fr->data.uint32;
+			out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC;
+			return out;
+		}
 		if (!(newdata = ast_malloc(fr->datalen + AST_FRIENDLY_OFFSET))) {
 			if (out->src != fr->src) {
 				ast_free((void *) out->src);