FGCOM/libpri
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

We should not be parsing further into the bearer capability IE if the length does not confirm that there actually is data present

Browse Source 
git-svn-id: https://origsvn.digium.com/svn/libpri/branches/1.2@513 2fbb986a-6c06-0410-b554-c9c1f0a7f128
This commit is contained in:
Matthew Fredrickson
2008-01-11 16:33:52 +00:00
parent 6be94aed97
commit 2e5dd8ec5d
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
q931.c
View File

@@ -576,8 +576,9 @@ static FUNC_DUMP(dump_bearer_capability)
pos++;
}
/* Stop here if no more */
if (pos >= len)
if (pos >= len - 2)
return;
if ((ie->data[1] & 0x7f) != TRANS_MODE_PACKET) {
/* Look for octets 5 and 5.a if present */
pri_message(pri, "%c Ext: %d User information layer 1: %s (%d)\n", prefix, (ie->data[pos] >> 7), l12str(ie->data[pos] & 0x7f), ie->data[pos] & 0x7f);
@@ -604,6 +605,10 @@ static FUNC_RECV(receive_bearer_capability)
call->transmoderate = ie->data[1] & 0x7f;
if (call->transmoderate == PRI_TRANS_CAP_AUDIO_4ESS)
call->transmoderate = PRI_TRANS_CAP_3_1K_AUDIO;
if (pos >= len - 2)
return 0;
if (call->transmoderate != TRANS_MODE_PACKET) {
call->userl1 = ie->data[pos] & 0x7f;
if (call->userl1 == PRI_LAYER_1_ITU_RATE_ADAPT) {