Fix segfault in chan_dahdi for CHANNEL(dahdi_span) evaluation on hangup.

* Added NULL private pointer checks in the following chan_dahdi channel
callbacks: dahdi_func_read(), dahdi_func_write(), dahdi_setoption(), and
dahdi_queryoption().

(closes issue ASTERISK-19142)
Reported by: Diego Aguirre
Tested by: rmudgett

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@349558 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 808e95ac00a54a02fac21a706476d91a4d00ef34..454543010833fc2cf0386e2b1a583b1b92cf0e92 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -6588,7 +6588,7 @@ static int dahdi_queryoption(struct ast_channel *chan, int option, void *data, i
        struct dahdi_pvt *p = chan->tech_pvt;
 
        /* all supported options require data */
-       if (!data || (*datalen < 1)) {
+       if (!p || !data || (*datalen < 1)) {
                errno = EINVAL;
                return -1;
        }
@@ -6634,7 +6634,7 @@ static int dahdi_setoption(struct ast_channel *chan, int option, void *data, int
 
 
        /* all supported options require data */
-       if (!data || (datalen < 1)) {
+       if (!p || !data || (datalen < 1)) {
                errno = EINVAL;
                return -1;
        }
@@ -6847,6 +6847,12 @@ static int dahdi_func_read(struct ast_channel *chan, const char *function, char
        struct dahdi_pvt *p = chan->tech_pvt;
        int res = 0;
 
+       if (!p) {
+               /* No private structure! */
+               *buf = '\0';
+               return -1;
+       }
+
        if (!strcasecmp(data, "rxgain")) {
                ast_mutex_lock(&p->lock);
                snprintf(buf, len, "%f", p->rxgain);
@@ -6980,6 +6986,11 @@ static int dahdi_func_write(struct ast_channel *chan, const char *function, char
        struct dahdi_pvt *p = chan->tech_pvt;
        int res = 0;
 
+       if (!p) {
+               /* No private structure! */
+               return -1;
+       }
+
        if (!strcasecmp(data, "buffers")) {
                int num_bufs, policy;