From e132aba5c94ac78b028466f38cdb9747626f4f04 Mon Sep 17 00:00:00 2001 From: "Kevin P. Fleming" Date: Tue, 6 Jun 2006 15:38:44 +0000 Subject: [PATCH] correct yesterday's security fix so that it doesn't improperly reject valid video frames git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.0@32565 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_iax2.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index d55734293b..a788234821 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -5052,11 +5052,21 @@ static int socket_read(int *id, int fd, short events, void *cbdata) ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr)); return 1; } - if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) { + if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) { + if (res < sizeof(*vh)) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a mini video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + + } /* This is a video frame, get call number */ fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1); minivid = 1; - } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) { + } else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) { + if (res < sizeof(*meta)) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + + } /* This is a meta header */ switch(meta->metacmd) { case IAX_META_TRUNK: @@ -5149,14 +5159,7 @@ static int socket_read(int *id, int fd, short events, void *cbdata) } return 1; } - /* if we got here and ->zeros contains zeros, this cannot be a valid - miniframe or full frame but it wasn't a valid video frame or meta - frame either, so we reject it - */ - if (vh->zeros == 0) { - ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); - return 1; - } + #ifdef DEBUG_SUPPORT if (iaxdebug) iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr)); -- 2.47.2