Memory corruption happened to the media frame caches when an audio hook
freed a frame when it shouldn't. I think the freed frame was because a
jitter buffer interpolated a missing frame and the audio hook
unconditionally freed it.
* Made audiohook.c:audio_audiohook_write_list() not free an interpolated
frame if it is the same frame as what was passed into the routine.
* Made plc.c:normalise_history() use memmove() instead of memcpy() on a
memory block that could overlap. Found by valgrind investigating this
issue.
ASTERISK-27238
ASTERISK-27412
Change-Id: I548d86894281fc4529aefeb9f161f2131ecc6fde
We've been calling pbx_builtin_setvar_helper to set the
RECORD_STATUS variable before actually closing the recorded file.
If a client is watching VarSet events and tries to do something with
the file when a RECORD_STATUS event is seen, they might attempt to
do so while the file it's still open.
We now delay calling pbx_builtin_setvar_helper until after we close
the file.
ASTERISK-27423
Change-Id: I7fe9de99953e46b4bafa2b38cf151fe8f6488254
Reduce the signal monitoring thread file descriptor use from two to one
on systems that support eventfd.
Change-Id: Id4041a237d481ff699639e153ea6982fee14a462
The remote console socket path is the combination of asterisk.conf
settings astrundir from [directories] and astctl from [files].
Unconditionally combine the two strings after processing all values
to ensure we end up with the correct socket path.
ASTERISK-27415
Change-Id: Ib1e2805d55d6b0955c6430a1a2a93acbf9b091e8
The default return code for pjsip_find_msg was PJ_SUCCESS so if
a Content-Length header wasn't found at all, pjsip_find_msg was
returning PJ_SUCCESS instead of PJSIP_EMISSINGHDR.
Also added the volatile keyword to a few variables that are used
both inside and outside the PJ_TRY/PJ_CATCH block.
Partial fix for ASTERISK_27408
Change-Id: If82ba9de921e3d57df9c68cf96ee45ccc1491f7a
Update from 2.7 to 2.7.1 for bundled pjproject. Changed version
and removed patch files included in the update.
Change-Id: I55cea8e734b318c2df9daf86aa0802c559ec8357
* AST_VECTOR_STEAL_ELEMENTS - steal the array of elements for use
with non-vector code.
* struct ast_vector_string - a vector of 'char *'.
Change-Id: I104d1b204be03fccf67e02a195596adcb5ab1e42
The media frame cache gets in the way of finding use after free errors of
media frames. Tools like valgrind and MALLOC_DEBUG don't know when a
frame is released because it gets put into the cache instead of being
freed.
* Added the "cache_media_frames" option to asterisk.conf. Disabling the
option helps track down media frame mismanagement when using valgrind or
MALLOC_DEBUG. The cache gets in the way of determining if the frame is
used after free and who freed it. NOTE: This option has no effect when
Asterisk is compiled with the LOW_MEMORY compile time option enabled
because the cache code does not exist.
To disable the media frame cache simply disable the cache_media_frames
option in asterisk.conf and restart Asterisk.
Sample asterisk.conf setting:
[options]
cache_media_frames=no
ASTERISK-27413
Change-Id: I0ab2ce0f4547cccf2eb214901835c2d951b78c00
If a transport is created with the same transport type, source
IP address, and source port as one that already exists the old
transport is moved into a linked list called "tp_list".
If this old transport is later shutdown it will not be destroyed
as the process checks whether the transport is valid or not. This
check does not look at the "tp_list" when making the determination
causing the transport to not be destroyed.
This change updates the logic to query not just the main storage
method for transports but also the "tp_list".
Upstream issue https://trac.pjsip.org/repos/ticket/2061
ASTERISK-27411
Change-Id: Ic5c2bb60226df0ef1c8851359ed8d4cd64469429
This ensures that the root Makefile runs only a single target at a time.
SUBMAKE will still honor requested parallelism, so 'make -j8' will build
one directory at a time but allow 8 jobs at once when building a sub
directory.
This will fix some display glitches related to rebuild of XML
documentation. It will also prevent some edge case errors where
bundled pjproject needs to be rebuild before other parts of Asterisk.
Change-Id: I4f2ec6fbbec1ada0ccb1109a28ea303524239b1e
This appeared in my audit of ast_stream_topology_set_stream callers
not checking for errors but in this situation the call cannot fail.
Add comment so this can be ignored in the future.
Change-Id: I91d25704859efbe50b8b82cfe1cd3c40ba177c9f
A previous commit made it so when an invite session transitioned into a
disconnected state destruction of the Asterisk pjsip session object was
postponed until either a transport error occurred or the event timer
expired. However, if a call was rejected (for instance a 488) before the
session was fully established the event timer may not have been initiated,
or it was canceled without triggering either of the session finalizing states
mentioned above.
Really the only time destruction of the session should be delayed is when a
BYE is being transacted. This is because it's possible in some cases for the
session to be disconnected, but the BYE is still transacting.
This patch makes it so the session object always gets released (no more
memory leak) when the pjsip session is in a disconnected state. Except when
the method is a BYE. Then it waits until a transport error occurs or an event
timeout.
ASTERISK-27345 #close
Reported by: Corey Farrell
Change-Id: I1e724737b758c20ac76d19d3611e3d2876ae10ed
cdr_object_update_party_b_userfield_cb() could overrun the fixed buffer if
the supplied string is too long. The long string could be supplied by
external means using the CDR(userfield) function.
This may seem reminiscent to AST-2017-001 (ASTERISK_26897) and it is. The
earlier patch fixed the buffer overrun for Party A's userfield while this
patch fixes the same thing for Party B's userfield.
ASTERISK-27337
Change-Id: I0fa767f65ecec7e676ca465306ff9e0edbf3b652
Parsing the numeric header fields like cseq, ttl, port, etc. all
had the potential to overflow, either causing unintended values to
be captured or, if the values were subsequently converted back to
strings, a buffer overrun. To address this, new "strto" functions
have been created that do range checking and those functions are
used wherever possible in the parser.
* Created pjlib/include/limits.h and pjlib/include/compat/limits.h
to either include the system limits.h or define common numeric
limits if there is no system limits.h.
* Created strto*_validate functions in sip_parser that take bounds
and on failure call the on_str_parse_error function which prints
an error message and calls PJ_THROW.
* Updated sip_parser to validate the numeric fields.
* Fixed an issue in sip_transport that prevented error messages
from being properly displayed.
* Added "volatile" to some variables referenced in PJ_CATCH blocks
as the optimizer was sometimes optimizing them away.
* Fixed length calculation in sip_transaction/create_tsx_key_2543
to account for signed ints being 11 characters, not 9.
ASTERISK-27319
Reported by: Youngsung Kim at LINE Corporation
Change-Id: I48de2e4ccf196990906304e8d7061f4ffdd772ff
