apps/app_voicemail: Fix crash with IMAP when streams are opened simultaneously

The UW IMAP library is instrinsically not thread-safe, and relies upon higher
level applications to guarantee thread safety. For the most part, this is
provided by the vms object, which provides locking for individual streams.
Unfortunately, this is not sufficient for calls to mail_open which create the
IMAP stream. mail_open can, on some systems, call into a UW IMAP specific
function for determining the address of a system based on a hostname,
ip_nametoaddr.

In the ip6_unix implementation of this function, static variables are used
to hold parsing buffers. This can cause a crash if multiple threads attempt
to convert a hostname to an address at the same time. Locking on a single
mail stream is not sufficient to prevent simultaneous access to these static
variables.

In the IMAP library, this function can be called from the mail_open and
imap_status functions. As the imap_status function is not used by
app_voicemail, locking on access to mail_open is sufficient to prevent
any mangling of the buffers.

Review: https://reviewboard.asterisk.org/r/4188/

ASTERISK-24516 #close
Reported by: David Duncan Ross Palmer
Tested by: David Duncan Ross Palmer
patches:
  ASTERISK-24516.diff uploaded by David Duncan Ross Palmer (License 6660)
........

Merged revisions 428863 from http://svn.asterisk.org/svn/asterisk/branches/11

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@428864 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c
index d1e2ef879cf12b5c93f27dee6a062e9db978395b..2df6e902f08a4180eec9f64ca8222df9e8e44970 100644 (file)
--- a/apps/app_voicemail.c
+++ b/apps/app_voicemail.c
@@ -509,6 +509,9 @@ static int expungeonhangup = 1;
 static int imapgreetings = 0;
 static char delimiter = '\0';
 
+/* mail_open cannot be protected on a stream basis */
+ast_mutex_t mail_open_lock;
+
 struct vm_state;
 struct ast_vm_user;
 
@@ -2936,7 +2939,9 @@ static int init_mailstream(struct vm_state *vms, int box)
                /* Connect to INBOX first to get folders delimiter */
                imap_mailbox_name(tmp, sizeof(tmp), vms, 0, 1);
                ast_mutex_lock(&vms->lock);
+               ast_mutex_lock(&mail_open_lock);
                stream = mail_open (stream, tmp, debug ? OP_DEBUG : NIL);
+               ast_mutex_unlock(&mail_open_lock);
                ast_mutex_unlock(&vms->lock);
                if (stream == NIL) {
                        ast_log(LOG_ERROR, "Can't connect to imap server %s\n", tmp);
@@ -2952,7 +2957,9 @@ static int init_mailstream(struct vm_state *vms, int box)
        imap_mailbox_name(tmp, sizeof(tmp), vms, box, 1);
        ast_debug(3, "Before mail_open, server: %s, box:%d\n", tmp, box);
        ast_mutex_lock(&vms->lock);
+       ast_mutex_lock(&mail_open_lock);
        vms->mailstream = mail_open (stream, tmp, debug ? OP_DEBUG : NIL);
+       ast_mutex_unlock(&mail_open_lock);
        ast_mutex_unlock(&vms->lock);
        if (vms->mailstream == NIL) {
                return -1;