kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-04 20:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent segfault if bad magic number is encountered.

Browse Source 
internal_ao2_ref uses INTERNAL_OBJ which mzy report 'bad magic number', but
internal_ao2_ref continues on, causing segfault.

Although AO2_MAGIC number is checked by INTERNAL_OBJ before internal_ao2_ref is
called, A02_MAGIC is being destroyed (or a wrong pointer) by the time
internal_ao2_ref uses INTERNAL_OBJ.

internal_ao2_ref now returns -1 if INTERNAL_OBJ encouters a bad magic number.

(issue #17037)
Reported by: alecdavis
Patches:
      bug17037.diff.txt uploaded by alecdavis (license 585)
Tested by: alecdavis




git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@253490 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Alec L Davis
2010-03-19 07:37:00 +00:00
parent 32a649c3b9
commit 743b168319
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
main/astobj2.c
View File

@@ -262,6 +262,9 @@ static int internal_ao2_ref(void *user_data, const int delta)
int current_value;
int ret;
if (obj == NULL)
return -1;
/* if delta is 0, just return the refcount */
if (delta == 0)
return (obj->priv_data.ref_counter);
@@ -499,7 +502,7 @@ static struct bucket_list *internal_ao2_link(struct ao2_container *c, void *user
struct bucket_list *p;
struct astobj2 *obj = INTERNAL_OBJ(user_data);
if (!obj)
if (obj == NULL)
return NULL;
if (INTERNAL_OBJ(c) == NULL)