Fix a small logic error in ast_event_iterator_next. The previous logic allowed for the iterator
to indicate there was more data than there really was, causing the iterator read beyond the end of the event structure. This led to invalid memory reads and potential crashes. git-svn-id: http://svn.digium.com/svn/asterisk/trunk@103559 f38db490-d61c-443f-a65b-d21fe96a405b
This commit is contained in:
parent
db10138f36
commit
4d009015b3
|
@ -383,7 +383,7 @@ void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct a
|
|||
int ast_event_iterator_next(struct ast_event_iterator *iterator)
|
||||
{
|
||||
iterator->ie = (struct ast_event_ie *) ( ((char *) iterator->ie) + sizeof(*iterator->ie) + ntohs(iterator->ie->ie_payload_len));
|
||||
return ((iterator->event_len < (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
|
||||
return ((iterator->event_len <= (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
|
||||
}
|
||||
|
||||
enum ast_event_ie_type ast_event_iterator_get_ie_type(struct ast_event_iterator *iterator)
|
||||
|
|
Reference in New Issue