From d359de6edbd3e66347bf7dccce530cf263b2bcd3 Mon Sep 17 00:00:00 2001 From: Russell Bryant Date: Tue, 17 Jul 2007 20:57:09 +0000 Subject: [PATCH] Properly check for the length in the skinny packet to prevent an invalid memcpy. (ASA-2007-016) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@75449 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_skinny.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c index 3cfd9d6468..c9d3f88548 100644 --- a/channels/chan_skinny.c +++ b/channels/chan_skinny.c @@ -2862,7 +2862,7 @@ static int get_input(struct skinnysession *s) return -1; } dlen = letohl(*(int *)s->inbuf); - if (dlen < 0) { + if (dlen < 4) { ast_log(LOG_WARNING, "Skinny Client sent invalid data.\n"); return -1; } -- 2.47.2