Ensure that we do not exceed the hold's maximum size with a single frame.

(closes issue #12047)
Reported by: fabianoheringer
Tested by: fabianoheringer

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@112125 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/slinfactory.h b/include/asterisk/slinfactory.h
index b81817d6bd8f1f302d3e9ad22e80d29c06bdc054..a65558bbb6c11bc9aa020129cfaab1a90f4c092c 100644 (file)
--- a/include/asterisk/slinfactory.h
+++ b/include/asterisk/slinfactory.h
@@ -31,10 +31,12 @@
 extern "C" {
 #endif
 
+#define AST_SLINFACTORY_MAX_HOLD 1280
+
 struct ast_slinfactory {
        AST_LIST_HEAD_NOLOCK(, ast_frame) queue;
        struct ast_trans_pvt *trans;
-       short hold[1280];
+       short hold[AST_SLINFACTORY_MAX_HOLD];
        short *offset;
        size_t holdlen;                 /*!< in samples */
        unsigned int size;              /*!< in samples */

diff --git a/main/slinfactory.c b/main/slinfactory.c
index df1af3738b0cfd980390ca674b5a8ed5a3847530..0022c62deff71bd2d1a07cf79bfe0d6cc1c4be24 100644 (file)
--- a/main/slinfactory.c
+++ b/main/slinfactory.c
@@ -137,6 +137,9 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
                                memcpy(offset, frame_data, ineed * sizeof(*offset));
                                sofar += ineed;
                                frame_data += ineed;
+                               if (remain > (AST_SLINFACTORY_MAX_HOLD - sf->holdlen)) {
+                                       remain = AST_SLINFACTORY_MAX_HOLD - sf->holdlen;
+                               }
                                memcpy(sf->hold, frame_data, remain * sizeof(*offset));
                                sf->holdlen = remain;
                        }