From: Chris Rienzo <chris.rienzo@grasshopper.com>
Date: Thu, 19 Sep 2013 03:20:26 +0000 (-0400)
Subject: FS-5790 --resolve mod_rayo: fix buffer overflow when reading stereo .wav file
X-Git-Tag: v1.5.8~94
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=de9bebc7790a256e46346532feb668c3b314bfb6;p=thirdparty%2Ffreeswitch.git

FS-5790 --resolve mod_rayo: fix buffer overflow when reading stereo .wav file
---

diff --git a/src/mod/event_handlers/mod_rayo/rayo_output_component.c b/src/mod/event_handlers/mod_rayo/rayo_output_component.c
index e85a12cece..e092ebd046 100644
--- a/src/mod/event_handlers/mod_rayo/rayo_output_component.c
+++ b/src/mod/event_handlers/mod_rayo/rayo_output_component.c
@@ -642,7 +642,7 @@ static switch_status_t fileman_file_open(switch_file_handle_t *handle, const cha
 	switch_mutex_unlock(fileman_globals.mutex);
 
 	context->max_frame_len = (handle->samplerate / 1000 * SWITCH_MAX_INTERVAL);
-	switch_zmalloc(context->abuf, FILE_STARTBYTES);
+	switch_zmalloc(context->abuf, FILE_STARTBYTES * sizeof(*context->abuf));
 
 	if (!context->fh.audio_buffer) {
 		switch_log_printf(SWITCH_CHANNEL_UUID_LOG(context->uuid), SWITCH_LOG_DEBUG, "Create audio buffer\n");