res_fax.c: Fix deadlock potential in FAXOPT(faxdetect) framehook.

The fax_detect_framehook() has the potential to deadlock if an incoming
fax happens during the Playback or similar application.

* Fixed the potential deadlock by not calling ast_async_goto() with the
channel lock held.

* Made always eat the fax detection frame whether there is a fax extension
or not.

* Made only detach the framehook if we detected a fax and not on other
possible frames.

ASTERISK-26216
Reported by: Richard Mudgett

Change-Id: I99da35c26d1cd802626ffb4c1b4eb5b015581b6d

diff --git a/res/res_fax.c b/res/res_fax.c
index ad6e2386c9afd3656efe9ea44d18c0a8865ffc53..ba4fc46800d3c59068587e2d636eeb6b4d4725db 100644 (file)
--- a/res/res_fax.c
+++ b/res/res_fax.c
@@ -3701,30 +3701,36 @@ static struct ast_frame *fax_detect_framehook(struct ast_channel *chan, struct a
        }
 
        if (result) {
-               const char *target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan));
+               const char *target_context;
+
                switch (result) {
                case 'f':
                case 't':
+                       target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan));
+
                        ast_channel_unlock(chan);
+                       ast_frfree(f);
+                       f = &ast_null_frame;
                        if (ast_exists_extension(chan, target_context, "fax", 1,
                            S_COR(ast_channel_caller(chan)->id.number.valid, ast_channel_caller(chan)->id.number.str, NULL))) {
-                               ast_channel_lock(chan);
                                ast_verb(2, "Redirecting '%s' to fax extension due to %s detection\n",
                                        ast_channel_name(chan), (result == 'f') ? "CNG" : "T38");
                                pbx_builtin_setvar_helper(chan, "FAXEXTEN", ast_channel_exten(chan));
                                if (ast_async_goto(chan, target_context, "fax", 1)) {
                                        ast_log(LOG_NOTICE, "Failed to async goto '%s' into fax of '%s'\n", ast_channel_name(chan), target_context);
                                }
-                               ast_frfree(f);
-                               f = &ast_null_frame;
                        } else {
-                               ast_channel_lock(chan);
                                ast_log(LOG_NOTICE, "FAX %s detected but no fax extension in context (%s)\n",
                                        (result == 'f') ? "CNG" : "T38", target_context);
                        }
+                       ast_channel_lock(chan);
+
+                       ast_framehook_detach(chan, details->faxdetect_id);
+                       details->faxdetect_id = -1;
+                       break;
+               default:
+                       break;
                }
-               ast_framehook_detach(chan, details->faxdetect_id);
-               details->faxdetect_id = -1;
        }
 
        return f;