Fix a variety of potential buffer overflows
[asterisk/asterisk.git] / main / jitterbuf.c
index 1ff261f..1e7191f 100644 (file)
@@ -242,7 +242,9 @@ static void history_calc_maxbuf(jitterbuf *jb)
                                /* found where it fits */
                                if (toins > jb->hist_maxbuf[j]) {
                                        /* move over */
-                                       memmove(jb->hist_maxbuf + j + 1, jb->hist_maxbuf + j, (JB_HISTORY_MAXBUF_SZ - (j + 1)) * sizeof(jb->hist_maxbuf[0]));
+                                       if (j != JB_HISTORY_MAXBUF_SZ - 1) {
+                                               memmove(jb->hist_maxbuf + j + 1, jb->hist_maxbuf + j, (JB_HISTORY_MAXBUF_SZ - (j + 1)) * sizeof(jb->hist_maxbuf[0]));
+                                       }
                                        /* insert */
                                        jb->hist_maxbuf[j] = toins;
 
@@ -259,7 +261,9 @@ static void history_calc_maxbuf(jitterbuf *jb)
                                /* found where it fits */
                                if (toins < jb->hist_minbuf[j]) {
                                        /* move over */
-                                       memmove(jb->hist_minbuf + j + 1, jb->hist_minbuf + j, (JB_HISTORY_MAXBUF_SZ - (j + 1)) * sizeof(jb->hist_minbuf[0]));
+                                       if (j != JB_HISTORY_MAXBUF_SZ - 1) {
+                                               memmove(jb->hist_minbuf + j + 1, jb->hist_minbuf + j, (JB_HISTORY_MAXBUF_SZ - (j + 1)) * sizeof(jb->hist_minbuf[0]));
+                                       }
                                        /* insert */
                                        jb->hist_minbuf[j] = toins;