From fed58bd1d611560fcf27a770ed958f7ad45b11b8 Mon Sep 17 00:00:00 2001 From: David Vossel Date: Thu, 7 Jan 2010 20:14:25 +0000 Subject: [PATCH] fixes crash in "scheduled_destroy" in chan_iax A signed short was used to represent a callnumber. This is makes it possible to attempt to access the iaxs array with a negative index. (closes issue #16565) Reported by: jensvb git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@238411 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_iax2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 7d321f45db..ac58c7703d 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1507,7 +1507,7 @@ retry: static int scheduled_destroy(const void *vid) { - short callno = PTR_TO_CALLNO(vid); + unsigned short callno = PTR_TO_CALLNO(vid); ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { if (option_debug) { -- 2.47.3