kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-03 03:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

features: Fix channel datastore access.

Browse Source 
Found as a result of the testsuite tests/callparking test crashing.

Several calls to ast_get_chan_featuremap_config() and
ast_get_chan_features_xfer_config() did not lock the channel before
calling so the channel's datastore list was accessed without the lock's
protection.  Apparently another thread deleted a datastore on the
channel's list while the crashing thread was walking the list.  Crash at
0xdeaddead due to MALLOC_DEBUG's memory filler value as a result.

* Add missing channel locks to calls that were not already protected
as the doxygen for those calls indicates.

Change-Id: Id273b3d305cc616406c353cbc841b2b7655efaa1
This commit is contained in:
Richard Mudgett
2016-06-30 15:17:02 -05:00
parent 5ad7e1c09a
commit 4f7b859726
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
main/bridge_channel.c
View File

@@ -1543,8 +1543,13 @@ static void testsuite_notify_feature_success(struct ast_channel *chan, const cha
{
#ifdef TEST_FRAMEWORK
char *feature = "unknown";
struct ast_featuremap_config *featuremap = ast_get_chan_featuremap_config(chan);
struct ast_features_xfer_config *xfer = ast_get_chan_features_xfer_config(chan);
struct ast_featuremap_config *featuremap;
struct ast_features_xfer_config *xfer;
ast_channel_lock(chan);
featuremap = ast_get_chan_featuremap_config(chan);
xfer = ast_get_chan_features_xfer_config(chan);
ast_channel_unlock(chan);
if (featuremap) {
if (!strcmp(dtmf, featuremap->blindxfer)) {

6
main/features.c
View File

@@ -766,8 +766,8 @@ static int action_bridge(struct mansession *s, const struct message *m)
astman_send_error(s, m, buf);
return 0;
}
xfer_cfg_a = ast_get_chan_features_xfer_config(chana);
ast_channel_lock(chana);
xfer_cfg_a = ast_get_chan_features_xfer_config(chana);
chana_exten = ast_strdupa(ast_channel_exten(chana));
chana_context = ast_strdupa(ast_channel_context(chana));
chana_priority = ast_channel_priority(chana);
@@ -782,8 +782,8 @@ static int action_bridge(struct mansession *s, const struct message *m)
astman_send_error(s, m, buf);
return 0;
}
xfer_cfg_b = ast_get_chan_features_xfer_config(chanb);
ast_channel_lock(chanb);
xfer_cfg_b = ast_get_chan_features_xfer_config(chanb);
chanb_exten = ast_strdupa(ast_channel_exten(chanb));
chanb_context = ast_strdupa(ast_channel_context(chanb));
chanb_priority = ast_channel_priority(chanb);
@@ -1097,7 +1097,9 @@ static int bridge_exec(struct ast_channel *chan, const char *data)
goto done;
}
ast_channel_lock(current_dest_chan);
xfer_cfg = ast_get_chan_features_xfer_config(current_dest_chan);
ast_channel_unlock(current_dest_chan);
bridge_add_failed = ast_bridge_add_channel(bridge, current_dest_chan, peer_features,
ast_test_flag(&opts, BRIDGE_OPT_PLAYTONE),
xfer_cfg ? xfer_cfg->xfersound : NULL);