diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c index 98d9d86d8ffb6e6db20e1927e232c71300e3b9bd..9de3faea689ae5320c8017f1bd1481de091eddc6 100644 --- a/channels/chan_skinny.c +++ b/channels/chan_skinny.c @@ -2305,6 +2305,10 @@ static int get_input(struct skinnysession *s) return -1; } dlen = *(int *)s->inbuf; + if (dlen < 0) { + ast_log(LOG_WARNING, "Skinny Client sent invalid data.\n"); + return -1; + } if (dlen+8 > sizeof(s->inbuf)) dlen = sizeof(s->inbuf) - 8; res = read(s->fd, s->inbuf+4, dlen+4);