Merged revisions 338800 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.8

........
  r338800 | rmudgett | 2011-09-30 17:05:10 -0500 (Fri, 30 Sep 2011) | 12 lines

  Fix segfault in analog_ss_thread() not checking ast_read() for NULL.

  NOTE: The problem was reported against v1.6.2.  It is unlikely to ever
  happen on v1.8 and above since chan_dahdi.c:analog_ss_thread() is unlikely
  to be used.  The version in sig_analog.c has largely replaced it.

  (closes issue ASTERISK-18648)
  Reported by: Stephan Bosch
  Patches:
        jira_asterisk_18648_v1.8.patch (license #5621) patch uploaded by rmudgett
  Tested by: Stephan Bosch
........

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@338801 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index b26881c43e72d316578a103be0af87e6acbebd30..11a7bda8b676eb9411483b9a3a8529a3c3be6574 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -10695,9 +10695,14 @@ static void *analog_ss_thread(void *data)
                                                ast_log(LOG_WARNING, "DTMFCID timed out waiting for ring. "
                                                        "Exiting simple switch\n");
                                                ast_hangup(chan);
-                                               return NULL;
+                                               goto quit;
                                        }
                                        f = ast_read(chan);
+                                       if (!f) {
+                                               /* Hangup received waiting for DTMFCID. Exiting simple switch. */
+                                               ast_hangup(chan);
+                                               goto quit;
+                                       }
                                        if (f->frametype == AST_FRAME_DTMF) {
                                                dtmfbuf[k++] = f->subclass.integer;
                                                ast_debug(1, "CID got digit '%c'\n", f->subclass.integer);