Re: [Iaxclient-devel] possible security hole in iax.c

[Peter G. <jpg...@gm...>]

Hi Alex,

On Tue, Apr 22, 2008 at 6:14 PM, Alexander Vassilev
<ava...@vo...> wrote:
> Actually, in the updated patch I didn't include one change, so here is again
> an update, hopefully the last one

I've reviewed the latest patch. Thank you so much for sending it! It
certainly addresses real issues.

There were a couple problems with the patch. A trivial problem was
that the whitespace was inconsistent. A more important problem was
that a mask was wrong:

-                       /* audio frame */
-                       session = iax_find_session(sin,
ntohs(fh->scallno), 0, 0);
+                       /*its a mini audio frame */
+                       session = iax_find_session(sin,
ntohs(mh->callno) & ~0x800, 0, 0);

I think you meant ~0x8000. This mask actually isn't necessary though
because we've already determined that the full flag is 0.

I am attaching an updated patch that I think resolves these two
issues. I also moved the "No session?" failure code to the bottom of
the function to reduce duplication.

Please let me know if you think this updated patch is okay.

Thanks!
Pete