mod_rayo: fix memory corruption in dial, input, output

diff --git a/src/mod/event_handlers/mod_rayo/mod_rayo.c b/src/mod/event_handlers/mod_rayo/mod_rayo.c
index 9c9fed2aa8216c307839f88002076807f88dbeeb..1f8449a7a235cb817b7b0ded896f229e6ed4f300 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/mod_rayo.c
+++ b/src/mod/event_handlers/mod_rayo/mod_rayo.c
@@ -2462,7 +2462,7 @@ static void *SWITCH_THREAD_FUNC rayo_dial_thread(switch_thread_t *thread, void *
                goto done;
        }
        call->dcp_jid = switch_core_strdup(RAYO_POOL(call), dcp_jid);
-       call->dial_request_id = iks_find_attrib(iq, "id");
+       call->dial_request_id = switch_core_strdup(RAYO_POOL(call), iks_find_attrib_soft(iq, "id"));
        switch_log_printf(SWITCH_CHANNEL_UUID_LOG(rayo_call_get_uuid(call)), SWITCH_LOG_INFO, "%s has control of call\n", dcp_jid);
        uuid = switch_core_strdup(dtdata->pool, rayo_call_get_uuid(call));
 
@@ -2571,7 +2571,7 @@ static void *SWITCH_THREAD_FUNC rayo_dial_thread(switch_thread_t *thread, void *
                        if (strncmp("+OK", api_stream.data, strlen("+OK"))) {
                                switch_log_printf(SWITCH_CHANNEL_UUID_LOG(uuid), SWITCH_LOG_INFO, "Failed to originate call\n");
 
-                               if (call->dial_request_id) {
+                               if (!zstr(call->dial_request_id)) {
                                        call->dial_request_failed = 1;
                                        call->dial_request_id = NULL;
 
@@ -2608,7 +2608,7 @@ static void *SWITCH_THREAD_FUNC rayo_dial_thread(switch_thread_t *thread, void *
                        switch_mutex_unlock(RAYO_ACTOR(call)->mutex);
                } else {
                        switch_mutex_lock(RAYO_ACTOR(call)->mutex);
-                       if (call->dial_request_id) {
+                       if (!zstr(call->dial_request_id)) {
                                switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "Failed to exec originate API\n");
                                call->dial_request_failed = 1;
                                call->dial_request_id = NULL;
@@ -3140,7 +3140,7 @@ static void on_call_originate_event(struct rayo_client *rclient, switch_event_t
                switch_log_printf(SWITCH_CHANNEL_UUID_LOG(RAYO_ID(call)), SWITCH_LOG_DEBUG, "Got originate event\n");
 
                switch_mutex_lock(RAYO_ACTOR(call)->mutex);
-               if (call->dial_request_id) {
+               if (!zstr(call->dial_request_id)) {
                        /* send response to DCP */
                        response = iks_new("iq");
                        iks_insert_attrib(response, "from", RAYO_JID(globals.server));
@@ -3178,7 +3178,7 @@ static void on_call_end_event(switch_event_t *event)
                switch_log_printf(SWITCH_CHANNEL_UUID_LOG(RAYO_ID(call)), SWITCH_LOG_DEBUG, "Got channel destroy event\n");
 
                switch_mutex_lock(RAYO_ACTOR(call)->mutex);
-               if (!call->dial_request_id && !call->dial_request_failed) {
+               if (zstr(call->dial_request_id) && !call->dial_request_failed) {
                        switch_event_dup(&call->end_event, event);
                        RAYO_DESTROY(call);
                        RAYO_UNLOCK(call); /* decrement ref from creation */

diff --git a/src/mod/event_handlers/mod_rayo/rayo_input_component.c b/src/mod/event_handlers/mod_rayo/rayo_input_component.c
index acb3decc6bad6842f517ec13248f81825e928f82..862c1aaa3c08a58fdc62d9f52f5ebaffbcb83b1d 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/rayo_input_component.c
+++ b/src/mod/event_handlers/mod_rayo/rayo_input_component.c
@@ -604,8 +604,8 @@ static iks *start_call_input(struct input_component *component, switch_core_sess
        component->barge_event = iks_find_bool_attrib(input, "barge-event");
        component->start_timers = iks_find_bool_attrib(input, "start-timers");
        component->term_digit = iks_find_char_attrib(input, "terminator");
-       component->recognizer = iks_find_attrib(input, "recognizer");
-       component->language = iks_find_attrib(input, "language");
+       component->recognizer = switch_core_strdup(RAYO_POOL(input), iks_find_attrib_soft(input, "recognizer"));
+       component->language = switch_core_strdup(RAYO_POOL(input), iks_find_attrib_soft(input, "language"));
        component->handler = handler;
        component->speech_mode = strcmp(iks_find_attrib_soft(input, "mode"), "dtmf");
 

diff --git a/src/mod/event_handlers/mod_rayo/rayo_output_component.c b/src/mod/event_handlers/mod_rayo/rayo_output_component.c
index c713450fd194cf826e8aaa96d37c80585d793b45..af426cb2255c3e724212f54e1186bd71a43d3787 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/rayo_output_component.c
+++ b/src/mod/event_handlers/mod_rayo/rayo_output_component.c
@@ -76,7 +76,7 @@ static struct rayo_component *create_output_component(struct rayo_actor *actor,
                output_component->repeat_times = iks_find_int_attrib(output, "repeat-times");
                output_component->max_time_ms = iks_find_int_attrib(output, "max-time");
                output_component->start_paused = iks_find_bool_attrib(output, "start-paused");
-               output_component->renderer = iks_find_attrib(output, "renderer");
+               output_component->renderer = switch_core_strdup(RAYO_POOL(actor), iks_find_attrib_soft(output, "renderer"));
        } else {
                switch_core_destroy_memory_pool(&pool);
        }

diff --git a/src/mod/event_handlers/mod_rayo/rayo_record_component.c b/src/mod/event_handlers/mod_rayo/rayo_record_component.c
index 1f3f3a68500b742e76b3ac5b3bc1cd2fa27f111c..2dfd817364f0247cec89ba83e793803df9a28d2f 100644 (file)
--- a/src/mod/event_handlers/mod_rayo/rayo_record_component.c
+++ b/src/mod/event_handlers/mod_rayo/rayo_record_component.c
@@ -170,7 +170,7 @@ static struct rayo_component *record_component_create(struct rayo_actor *actor,
 
        switch_core_new_memory_pool(&pool);
        record_component = switch_core_alloc(pool, sizeof(*record_component));
-       record_component = RECORD_COMPONENT(rayo_component_init(RAYO_COMPONENT(record_component), pool, type, "record", fs_file_path, actor, client_jid));\
+       record_component = RECORD_COMPONENT(rayo_component_init(RAYO_COMPONENT(record_component), pool, type, "record", fs_file_path, actor, client_jid));
        if (record_component) {
                record_component->max_duration = iks_find_int_attrib(record, "max-duration");
                record_component->initial_timeout = iks_find_int_attrib(record, "initial-timeout");