Since adding the AST_CONTROL_SRCUPDATE frame type,

there are places where ast_rtp_new_source may be called
where the tech_pvt of a channel may not yet have an
rtp structure allocated. This caused a crash in chan_skinny,
which was fixed earlier, but now the same crash has been
reported against chan_h323 as well. It seems that the best
solution is to modify ast_rtp_new_source to not attempt to
set the marker bit if the rtp structure passed in is NULL.

This change to ast_rtp_new_source also allows the removal
of what is now a redundant pointer check from chan_skinny.

(closes issue #13247)
Reported by: pj

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@136062 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index 80ce09201dcb16abc3e99eefef06aa584f3a639e..51b1839d5363964e97c8eeea269bb3c35883647c 100644 (file)
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -2868,9 +2868,7 @@ static int skinny_indicate(struct ast_channel *ast, int ind, const void *data, s
        case AST_CONTROL_PROCEEDING:
                break;
        case AST_CONTROL_SRCUPDATE:
-               if (sub->rtp) {
-                       ast_rtp_new_source(sub->rtp);
-               }
+               ast_rtp_new_source(sub->rtp);
                break;
        default:
                ast_log(LOG_WARNING, "Don't know how to indicate condition %d\n", ind);

diff --git a/main/rtp.c b/main/rtp.c
index 14d8aafcdbc51cfac23e7d87ae9c39daa5ad8d4d..bbdb9d6496fca043462abc18d4d25fc469493d0a 100644 (file)
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -2000,7 +2000,9 @@ int ast_rtp_settos(struct ast_rtp *rtp, int tos)
 
 void ast_rtp_new_source(struct ast_rtp *rtp)
 {
-       rtp->set_marker_bit = 1;
+       if (rtp) {
+               rtp->set_marker_bit = 1;
+       }
        return;
 }