From b66aa676faa786bf96bada8d7f769a2de7d15380 Mon Sep 17 00:00:00 2001
From: Tilghman Lesher <tilghman@meg.abyt.es>
Date: Fri, 11 Jul 2008 18:52:42 +0000
Subject: [PATCH] Merged revisions 130169 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r130169 | tilghman | 2008-07-11 13:51:56 -0500 (Fri, 11 Jul 2008) | 7 lines

Ensure that a destination callno of 0 will not match for frames that do not
start a dialog (new, lagrq, and ping).
(closes issue #12963)
 Reported by: russellb
 Patches:
       chan_iax2_dup_new_fix4.patch uploaded by jpgrayson (license 492)

........


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@130170 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 channels/chan_iax2.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 528bd68d42..3a364fd7de 100644
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -8046,12 +8046,21 @@ static int socket_process(struct iax2_thread *thread)
 		 * Discussed in the following thread:
 		 * http://lists.digium.com/pipermail/asterisk-dev/2008-May/033217.html 
 		 */
-		if (f.frametype != AST_FRAME_IAX ||
-				(f.subclass != IAX_COMMAND_NEW &&
-				 f.subclass != IAX_COMMAND_PING &&
-				 f.subclass != IAX_COMMAND_LAGRQ)) {
-			/* Get the destination call number */
-			dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
+
+		/* Get the destination call number */
+		dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
+
+		if (f.frametype == AST_FRAME_IAX &&
+				(f.subclass == IAX_COMMAND_NEW ||
+				 f.subclass == IAX_COMMAND_PING ||
+				 f.subclass == IAX_COMMAND_LAGRQ)) {
+			dcallno = 0;
+		} else if (!dcallno) {
+			/* All other full-frames must have a non-zero dcallno,
+			 * We silently drop this frame since it cannot be a
+			 * valid match to an existing call session.
+			 */
+			return 1;
 		}
 		if ((f.frametype == AST_FRAME_IAX) && ((f.subclass == IAX_COMMAND_NEW) || (f.subclass == IAX_COMMAND_REGREQ) ||
 						       (f.subclass == IAX_COMMAND_POKE) || (f.subclass == IAX_COMMAND_FWDOWNL) ||
-- 
GitLab