importing files for 1.2.9.1 release

git-svn-id: https://origsvn.digium.com/svn/asterisk/tags/1.2.9.1@32601 65c4cc65-6c06-0410-ace0-fbb531ad65f3

.version

@@ -1 +1 @@
-1.2.9
+1.2.9.1

CREDITS

@@ -87,7 +87,7 @@ Leif Madsen, Jared Smith and Jim van Meggelen - the Asterisk book
 	available under a Creative Commons License at http://www.asteriskdocs.org
 
 === HOLD MUSIC ===
-Music provided by www.opsound.org
+Music provided by www.freeplaymusic.com
 
 === OTHER SOURCE CODE IN ASTERISK ===
 

ChangeLog

@@ -1,3 +1,16 @@
+2006-06-06 Kevin P. Fleming <kpfleming@digium.com>
+
+	* Asterisk 1.2.9.1 released
+
+2006-06-06 16:02 +0000 [r32582]  Tilghman Lesher <tilghman@mail.jeffandtilghman.com>
+
+	* callerid.c: Bug 7268 - Callerid leaks memory on error
+
+2006-06-06 15:48 +0000 [r32566]  Kevin P. Fleming <kpfleming@digium.com>
+
+	* channels/chan_iax2.c: clean up yesterday's security fix to not
+	  cause breakage when video mini frames are received
+
 2006-06-03 Kevin P. Fleming <kpfleming@digium.com>
 
 	* Asterisk 1.2.9 released

README.fpm

@@ -0,0 +1,8 @@
+About Hold Music
+================
+Digium has licensed the music included with
+the Asterisk distribution From FreePlayMusic
+for use and distribution with Asterisk.  It
+is licensed ONLY for use as hold music within
+an Asterisk based PBX.
+

README.opsound

@@ -1,22 +0,0 @@
-About Hold Music
-================
-These files were obtained from http://opsound.org, where the authors placed them
-under the Creative Commons Attribution-Share Alike 2.5 license, a copy of which
-may be found at http://creativecommons.org.
-
-Credits
-================
-macroform-cold_day - Paul Shuler (Macroform)
-paulshuler@gmail.com - http://macroform.bandcamp.com/
-
-macroform-robot_dity - Paul Shuler (Macroform)
-paulshuler@gmail.com - http://macroform.bandcamp.com/
-
-macroform-the_simplicity - Paul Shuler (Macroform)
-paulshuler@gmail.com - http://macroform.bandcamp.com/
-
-manolo_camp-morning_coffee - Manolo Camp
-beatbastard@gmx.net - http://ccmixter.org/people/ManoloCamp
-
-reno_project-system - Reno Project
-renoproject@hotmail.com - http://www.jamendo.com/en/album/23661

callerid.c

@@ -274,6 +274,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
 		res = fsk_serie(&cid->fskd, buf, &mylen, &b);
 		if (mylen < 0) {
 			ast_log(LOG_ERROR, "fsk_serie made mylen < 0 (%d)\n", mylen);
+			free(obuf);
 			return -1;
 		}
 		buf += (olen - mylen);
@@ -307,6 +308,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
 			case 4: /* Retrieve message */
 				if (cid->pos >= 128) {
 					ast_log(LOG_WARNING, "Caller ID too long???\n");
+					free(obuf);
 					return -1;
 				}
 				cid->rawdata[cid->pos++] = b;
@@ -392,6 +394,7 @@ int callerid_feed(struct callerid_state *cid, unsigned char *ubuf, int len, int
 					strcpy(cid->name, "");
 					cid->flags |= CID_UNKNOWN_NAME;
 				}
+				free(obuf);
 				return 1;
 				break;
 			default:

channels/chan_iax2.c

@@ -6327,12 +6327,23 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		ast_log(LOG_WARNING, "midget packet received (%d of %zd min)\n", res, sizeof(*mh));
 		return 1;
 	}
-	if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
+	if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+		if (res < sizeof(*vh)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* This is a video frame, get call number */
 		fr->callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1, fd);
 		minivid = 1;
-	} else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
+	} else if ((meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
 		unsigned char metatype;
+
+		if (res < sizeof(*meta)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a meta frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* This is a meta header */
 		switch(meta->metacmd) {
 		case IAX_META_TRUNK:
@@ -6454,20 +6465,16 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		return 1;
 	}
 
-	/* if we got here and ->zeros contains zeros, this cannot be a valid
-	   miniframe or full frame but it wasn't a valid video frame or meta
-	   frame either, so we reject it
-	*/
-	if (vh->zeros == 0) {
-		ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
-		return 1;
-	}
-
 #ifdef DEBUG_SUPPORT
 	if (iaxdebug && (res >= sizeof(*fh)))
 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(*fh));
 #endif
-	if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) {
+	if (ntohs(mh->callno) & IAX_FLAG_FULL) {
+		if (res < sizeof(*fh)) {
+			ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a full frame but is too short\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+			return 1;
+		}
+
 		/* Get the destination call number */
 		dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
 		/* Retrieve the type and subclass */