From: Tilghman Lesher <tilghman@meg.abyt.es>
Date: Thu, 1 Oct 2009 23:53:12 +0000 (+0000)
Subject: Fix a bunch of off-by-one errors
X-Git-Tag: 1.4.27-rc2~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=366ef836c1fe4c0d00041cb105f84562a226fcd4;p=thirdparty%2Fasterisk.git

Fix a bunch of off-by-one errors


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@221776 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/asterisk.c b/main/asterisk.c
index d915b4bdb0..c941315129 100644
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -963,7 +963,7 @@ static void *netconsole(void *vconsole)
 			continue;
 		}
 		if (fds[0].revents) {
-			res = read(con->fd, tmp, sizeof(tmp));
+			res = read(con->fd, tmp, sizeof(tmp) - 1);
 			if (res < 1) {
 				break;
 			}
@@ -2144,7 +2144,7 @@ static char *cli_complete(EditLine *el, int ch)
 	if (ast_opt_remote) {
 		snprintf(buf, sizeof(buf),"_COMMAND NUMMATCHES \"%s\" \"%s\"", lf->buffer, ptr); 
 		fdsend(ast_consock, buf);
-		res = read(ast_consock, buf, sizeof(buf));
+		res = read(ast_consock, buf, sizeof(buf) - 1);
 		buf[res] = '\0';
 		nummatches = atoi(buf);
 
diff --git a/main/rtp.c b/main/rtp.c
index 770292a4f9..519ecf35cf 100644
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -1696,7 +1696,7 @@ int ast_rtp_make_compatible(struct ast_channel *dest, struct ast_channel *src, i
  */
 void ast_rtp_set_m_type(struct ast_rtp* rtp, int pt) 
 {
-	if (pt < 0 || pt > MAX_RTP_PT || static_RTP_PT[pt].code == 0) 
+	if (pt < 0 || pt >= MAX_RTP_PT || static_RTP_PT[pt].code == 0) 
 		return; /* bogus payload type */
 
 	ast_mutex_lock(&rtp->bridge_lock);
@@ -1708,7 +1708,7 @@ void ast_rtp_set_m_type(struct ast_rtp* rtp, int pt)
     an unknown media type */
 void ast_rtp_unset_m_type(struct ast_rtp* rtp, int pt) 
 {
-	if (pt < 0 || pt > MAX_RTP_PT)
+	if (pt < 0 || pt >= MAX_RTP_PT)
 		return; /* bogus payload type */
 
 	ast_mutex_lock(&rtp->bridge_lock);
@@ -1728,7 +1728,7 @@ int ast_rtp_set_rtpmap_type(struct ast_rtp *rtp, int pt,
 	unsigned int i;
 	int found = 0;
 
-	if (pt < 0 || pt > MAX_RTP_PT) 
+	if (pt < 0 || pt >= MAX_RTP_PT) 
 		return -1; /* bogus payload type */
 	
 	ast_mutex_lock(&rtp->bridge_lock);
@@ -1780,7 +1780,7 @@ struct rtpPayloadType ast_rtp_lookup_pt(struct ast_rtp* rtp, int pt)
 
 	result.isAstFormat = result.code = 0;
 
-	if (pt < 0 || pt > MAX_RTP_PT) 
+	if (pt < 0 || pt >= MAX_RTP_PT) 
 		return result; /* bogus payload type */
 
 	/* Start with negotiated codecs */
@@ -2846,7 +2846,7 @@ struct ast_codec_pref *ast_rtp_codec_getpref(struct ast_rtp *rtp)
 
 int ast_rtp_codec_getformat(int pt)
 {
-	if (pt < 0 || pt > MAX_RTP_PT)
+	if (pt < 0 || pt >= MAX_RTP_PT)
 		return 0; /* bogus payload type */
 
 	if (static_RTP_PT[pt].isAstFormat)
diff --git a/main/say.c b/main/say.c
index 439855bf4a..507c3c3e2f 100644
--- a/main/say.c
+++ b/main/say.c
@@ -3254,7 +3254,7 @@ int ast_say_date_with_format_en(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -3502,7 +3502,7 @@ int ast_say_date_with_format_da(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -3707,7 +3707,7 @@ int ast_say_date_with_format_de(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -3939,7 +3939,7 @@ int ast_say_date_with_format_he(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -4094,7 +4094,7 @@ int ast_say_date_with_format_es(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				snprintf(nextmsg,sizeof(nextmsg), "%s", sndfile);
@@ -4286,7 +4286,7 @@ int ast_say_date_with_format_fr(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -4484,7 +4484,7 @@ int ast_say_date_with_format_it(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 				sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -4717,7 +4717,7 @@ int ast_say_date_with_format_nl(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -4923,7 +4923,7 @@ int ast_say_date_with_format_pl(struct ast_channel *chan, time_t thetime, const
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset = 0;
-				for (sndoffset = 0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset = 0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -5141,7 +5141,7 @@ int ast_say_date_with_format_pt(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				snprintf(nextmsg,sizeof(nextmsg), "%s", sndfile);
@@ -5431,7 +5431,7 @@ int ast_say_date_with_format_zh(struct ast_channel *chan, time_t time, const cha
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan,ints,sndfile,lang);
@@ -6808,7 +6808,7 @@ static int ast_say_date_with_format_gr(struct ast_channel *chan, time_t time, co
 		case '\'':
 			/* Literal name of a sound file */
 			sndoffset=0;
-			for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < 256) ; sndoffset++)
+			for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 				sndfile[sndoffset] = format[offset];
 			sndfile[sndoffset] = '\0';
 			res = wait_file(chan,ints,sndfile,lang);