Ensure that we do not exceed the hold's maximum size with a single frame.

(closes issue #12047)
Reported by: fabianoheringer
Tested by: fabianoheringer


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@112125 65c4cc65-6c06-0410-ace0-fbb531ad65f3

include/asterisk/slinfactory.h

@@ -31,10 +31,12 @@
 extern "C" {
 #endif
 
+#define AST_SLINFACTORY_MAX_HOLD 1280
+
 struct ast_slinfactory {
 	AST_LIST_HEAD_NOLOCK(, ast_frame) queue;
 	struct ast_trans_pvt *trans;
-	short hold[1280];
+	short hold[AST_SLINFACTORY_MAX_HOLD];
 	short *offset;
 	size_t holdlen;			/*!< in samples */
 	unsigned int size;		/*!< in samples */

main/slinfactory.c

@@ -137,6 +137,9 @@ int ast_slinfactory_read(struct ast_slinfactory *sf, short *buf, size_t samples)
 				memcpy(offset, frame_data, ineed * sizeof(*offset));
 				sofar += ineed;
 				frame_data += ineed;
+				if (remain > (AST_SLINFACTORY_MAX_HOLD - sf->holdlen)) {
+					remain = AST_SLINFACTORY_MAX_HOLD - sf->holdlen;
+				}
 				memcpy(sf->hold, frame_data, remain * sizeof(*offset));
 				sf->holdlen = remain;
 			}