From 616e3502e7993b5380fb2a32d25af577eba1d42d Mon Sep 17 00:00:00 2001 From: Tilghman Lesher Date: Tue, 8 May 2007 06:20:16 +0000 Subject: [PATCH] Issue 9527 - upon entering a folder, no message is selected (curmsg == -1), so deleting causes memory corruption (beyond bounds) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@63359 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- apps/app_voicemail.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c index ce6b545fd7..caa81a3fd7 100644 --- a/apps/app_voicemail.c +++ b/apps/app_voicemail.c @@ -5443,21 +5443,24 @@ static int vm_execmain(struct ast_channel *chan, void *data) } break; case '7': - vms.deleted[vms.curmsg] = !vms.deleted[vms.curmsg]; - if (useadsi) - adsi_delete(chan, &vms); - if (vms.deleted[vms.curmsg]) - cmd = ast_play_and_wait(chan, "vm-deleted"); - else - cmd = ast_play_and_wait(chan, "vm-undeleted"); - if (ast_test_flag((&globalflags), VM_SKIPAFTERCMD)) { - if (vms.curmsg < vms.lastmsg) { - vms.curmsg++; - cmd = play_message(chan, vmu, &vms); - } else { - cmd = ast_play_and_wait(chan, "vm-nomore"); + if (vms.curmsg >= 0 && vms.curmsg <= vms.lastmsg) { + vms.deleted[vms.curmsg] = !vms.deleted[vms.curmsg]; + if (useadsi) + adsi_delete(chan, &vms); + if (vms.deleted[vms.curmsg]) + cmd = ast_play_and_wait(chan, "vm-deleted"); + else + cmd = ast_play_and_wait(chan, "vm-undeleted"); + if (ast_test_flag((&globalflags), VM_SKIPAFTERCMD)) { + if (vms.curmsg < vms.lastmsg) { + vms.curmsg++; + cmd = play_message(chan, vmu, &vms); + } else { + cmd = ast_play_and_wait(chan, "vm-nomore"); + } } - } + } else /* Delete not valid if we haven't selected a message */ + cmd = 0; break; case '8':