[Pkg-voip-commits] r2114 - asterisk/trunk/debian/patches

Mark Purcell msp at costa.debian.org
Thu Jul 27 07:19:40 UTC 2006


Author: msp
Date: 2006-07-27 07:19:39 +0000 (Thu, 27 Jul 2006)
New Revision: 2114

Modified:
   asterisk/trunk/debian/patches/patch.CVE-2006-2898.dpatch
Log:
Fixup patch

Modified: asterisk/trunk/debian/patches/patch.CVE-2006-2898.dpatch
===================================================================
--- asterisk/trunk/debian/patches/patch.CVE-2006-2898.dpatch	2006-07-27 07:10:59 UTC (rev 2113)
+++ asterisk/trunk/debian/patches/patch.CVE-2006-2898.dpatch	2006-07-27 07:19:39 UTC (rev 2114)
@@ -5,36 +5,15 @@
 ## DP: a denial of service.
 
 @DPATCH@
---- asterisk-1.0.7.dfsg.1.orig/channels/chan_iax2.c	2005-03-18 18:30:05.000000000 +0100
- ++ asterisk-1.0.7.dfsg.1/channels/chan_iax2.c	2006-06-07 08:17:19.000000000 +0200
-@@ -5064,10 +5064,20 @@ static int socket_read(int *id, int fd, 
- 		return 1;
- 	}
- 	if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
-+		if (res < sizeof(*vh)) {
-+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a mini video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-+			return 1;
-+			
-+		}
- 		/* This is a video frame, get call number */
- 		fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1);
- 		minivid = 1;
--	} else if (meta->zeros == 0) {
-+	} else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
-+		if (res < sizeof(*meta)) {
-+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-+			return 1;
-+			
-+		}
- 		/* This is a meta header */
- 		switch(meta->metacmd) {
- 		case IAX_META_TRUNK:
-@@ -5164,7 +5174,7 @@ static int socket_read(int *id, int fd, 
- 	if (iaxdebug)
- 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr));
+diff -urNad asterisk-1.2.10.dfsg~/channels/chan_iax2.c asterisk-1.2.10.dfsg/channels/chan_iax2.c
+--- asterisk-1.2.10.dfsg~/channels/chan_iax2.c	2006-07-12 16:23:59.000000000 +0100
++++ asterisk-1.2.10.dfsg/channels/chan_iax2.c	2006-07-27 08:17:52.000000000 +0100
+@@ -6531,7 +6531,7 @@
+ 	if (iaxdebug && (res >= sizeof(*fh)))
+ 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(*fh));
  #endif
 -	if (ntohs(mh->callno) & IAX_FLAG_FULL) {
 +	if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) {
- 		/* Get the destination call number */
- 		dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
- 		/* Retrieve the type and subclass */
+ 		if (res < sizeof(*fh)) {
+ 			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a full frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+ 			return 1;




More information about the Pkg-voip-commits mailing list