From 56e1e9c83ecb9ed4d5565830b55ba32c136b3ba8 Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Thu, 21 Mar 2013 13:49:33 -0500 Subject: [PATCH] FS-5202 --- src/mod/applications/mod_spandsp/udptl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/mod/applications/mod_spandsp/udptl.c b/src/mod/applications/mod_spandsp/udptl.c index 94a31e6772..8f74508f62 100644 --- a/src/mod/applications/mod_spandsp/udptl.c +++ b/src/mod/applications/mod_spandsp/udptl.c @@ -195,7 +195,7 @@ int udptl_rx_packet(udptl_state_t *s, const uint8_t buf[], int len) s->rx[x].fec_len[0] = 0; s->rx[x].fec_span = 0; s->rx[x].fec_entries = 0; - if ((buf[ptr++] & 0x80) == 0) { + if ((buf[ptr++] & 0x80) q== 0) { /* Secondary packet mode for error recovery */ /* We might have the packet we want, but we need to check through the redundant stuff, and verify the integrity of the UDPTL. @@ -228,6 +228,9 @@ int udptl_rx_packet(udptl_state_t *s, const uint8_t buf[], int len) /* Save the new packet. Redundancy mode won't use this, but some systems will switch into FEC mode after sending some redundant packets, and this may then be important. */ x = (seq_no - i) & UDPTL_BUF_MASK; + if (!bufs[i - 1]) { + return -1; + } memcpy(s->rx[x].buf, bufs[i - 1], lengths[i - 1]); s->rx[x].buf_len = lengths[i - 1]; s->rx[x].fec_len[0] = 0;