Merged revisions 335497 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.8

........
  r335497 | russell | 2011-09-13 02:11:36 -0500 (Tue, 13 Sep 2011) | 15 lines

  Fix a crash in res_ais.

  This patch resolves a crash observed in a load testing environment that
  involved the use of the res_ais module.  I observed some crashes where
  the event delivery callback would get called, but the length parameter
  incidcating how much data there was to read was 0.  The code assumed
  (with good reason I would think) that if this callback got called, there
  was an event available to read.  However, if the rare case that there's
  nothing there, catch it and return instead of blowing up.

  More specifically, the change always ensure that the size of the received
  event in the cluster is always big enough to be a real ast_event.

  Review: https://reviewboard.asterisk.org/r/1423/
........

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@335510 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/event.h b/include/asterisk/event.h
index 73f121c97d332d24f93403f8447de4c0a50541ef..90e27b2f6c6932ee3cbe5c65011aca47d2034d88 100644 (file)
--- a/include/asterisk/event.h
+++ b/include/asterisk/event.h
@@ -743,6 +743,13 @@ void *ast_event_iterator_get_ie_raw(struct ast_event_iterator *iterator);
  */
 uint16_t ast_event_iterator_get_ie_raw_payload_len(struct ast_event_iterator *iterator);
 
+/*!
+ * \brief Get the minimum length of an ast_event.
+ *
+ * \return minimum amount of memory that will be consumed by any ast_event.
+ */
+size_t ast_event_minimum_length(void);
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif

diff --git a/main/event.c b/main/event.c
index fad8e66ee7cbfcd84f7226c9e30b5159c1b62d5e..a62e736376abc17971e36856fef9ef7ed4b49143 100644 (file)
--- a/main/event.c
+++ b/main/event.c
@@ -1769,3 +1769,8 @@ int ast_event_init(void)
 
        return 0;
 }
+
+size_t ast_event_minimum_length(void)
+{
+       return sizeof(struct ast_event);
+}

diff --git a/res/ais/evt.c b/res/ais/evt.c
index 88b8a6ffd78b51ddf6d37931f4d864d8dfc220d2..8d11c647312c81c4cc2dc835cd2eea05a0628e24 100644 (file)
--- a/res/ais/evt.c
+++ b/res/ais/evt.c
@@ -135,6 +135,13 @@ void evt_event_deliver_cb(SaEvtSubscriptionIdT sub_id,
                return;
        }
 
+       if (event_datalen < ast_event_minimum_length()) {
+               ast_debug(1, "Ignoring event that's too small. %u < %u\n",
+                       (unsigned int) event_datalen,
+                       (unsigned int) ast_event_minimum_length());
+               return;
+       }
+
        ais_res = saEvtEventDataGet(event_handle, event, &len);
        if (ais_res != SA_AIS_OK) {
                ast_log(LOG_ERROR, "Error retrieving event payload: %s\n",