From 23fc97480e500c9310794c6e5c5ae7ba998f4e9c Mon Sep 17 00:00:00 2001
From: Mark Michelson <mmichelson@digium.com>
Date: Wed, 13 Feb 2008 00:55:09 +0000
Subject: [PATCH] Fix a small logic error in ast_event_iterator_next. The
previous logic allowed for the iterator to indicate there was more data than
there really was, causing the iterator read beyond the end of the event
structure. This led to invalid memory reads and potential crashes.
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@103559 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
main/event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/main/event.c b/main/event.c
index 705063b823..0d139c51af 100644
--- a/main/event.c
+++ b/main/event.c
@@ -383,7 +383,7 @@ void ast_event_iterator_init(struct ast_event_iterator *iterator, const struct a
int ast_event_iterator_next(struct ast_event_iterator *iterator)
{
iterator->ie = (struct ast_event_ie *) ( ((char *) iterator->ie) + sizeof(*iterator->ie) + ntohs(iterator->ie->ie_payload_len));
- return ((iterator->event_len < (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
+ return ((iterator->event_len <= (((char *) iterator->ie) - ((char *) iterator->event))) ? -1 : 0);
}
enum ast_event_ie_type ast_event_iterator_get_ie_type(struct ast_event_iterator *iterator)
--
GitLab