Fix buffer overflow in slin sample frames generation.
authorIvan Poddubny <ivan.poddubny@gmail.com>
Sun, 31 May 2015 16:33:37 +0000 (19:33 +0300)
committerIvan Poddubny <ivan.poddubny@gmail.com>
Sun, 31 May 2015 17:29:21 +0000 (12:29 -0500)
The length of frames retured by sample functions was twice as large as
real, what caused global buffer overflow caught by AddressSanitizer.

ASTERISK-24717 #close
Reported by: Badalian Vyacheslav

Change-Id: Iec2fe682aef13e556684912f906bedf7c18229c6

include/asterisk/slin.h

index 148ee09..9766374 100644 (file)
@@ -62,7 +62,7 @@ static inline struct ast_frame *slin8_sample(void)
 {
        static struct ast_frame f = {
                .frametype = AST_FRAME_VOICE,
-               .datalen = sizeof(ex_slin8) * 2,
+               .datalen = sizeof(ex_slin8),
                .samples = ARRAY_LEN(ex_slin8),
                .mallocd = 0,
                .offset = 0,
@@ -79,7 +79,7 @@ static inline struct ast_frame *slin16_sample(void)
 {
        static struct ast_frame f = {
                .frametype = AST_FRAME_VOICE,
-               .datalen = sizeof(ex_slin16) * 2,
+               .datalen = sizeof(ex_slin16),
                .samples = ARRAY_LEN(ex_slin16),
                .mallocd = 0,
                .offset = 0,