From 6611e15d127fb35987e3271b2015b13c2d79f621 Mon Sep 17 00:00:00 2001 From: Donat Zenichev Date: Wed, 27 May 2026 17:32:39 +0200 Subject: [PATCH] MT#61856 call_interfaces: streams print hardening The loop is 1-based, but checks the outside of bounds with `i <= 1`. If the length is 1 and iterator is 1, this already fails. Hence allow `i` to be 1, and also check it's not beyound the media array length. Change-Id: I9112fc88155fa53205c04ef35b00f6573b6816b3 --- daemon/call_interfaces.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon/call_interfaces.c b/daemon/call_interfaces.c index 6e76bfb31..86c9468db 100644 --- a/daemon/call_interfaces.c +++ b/daemon/call_interfaces.c @@ -76,7 +76,7 @@ static str streams_print(medias_arr *s, int start, int end, const char *prefix, g_string_append_printf(o, "%s ", prefix); for (i = start; i <= end; i++) { - if (s->len <= i || (media = s->pdata[i - 1]) == NULL) { + if (i < 1 || i > s->len || (media = s->pdata[i - 1]) == NULL) { ilog(LOG_WARNING, "Requested media index %i not found", i); break; }