Audit improper usage of scheduler exposed by 5c713fdf18f.

channels/chan_iax2.c:
* Initialize struct chan_iax2_pvt scheduler ids earlier because of
iax2_destroy_helper().

channels/chan_sip.c:
channels/sip/config_parser.c:
* Fix initialization of scheduler id struct members.  Some off nominal
paths had 0 as a scheduler id to be destroyed when it was never started.

chan_skinny.c:
* Fix some scheduler id comparisons that excluded the valid 0 id.

channel.c:
* Fix channel initialization of the video stream scheduler id.

pbx_dundi.c:
* Fix channel initialization of the packet retransmission scheduler id.

ASTERISK-25476

Change-Id: I07a3449f728f671d326a22fcbd071f150ba2e8c8

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 7d962e2a78b03eefcf4bdd426492877a80aebbc1..be5afa6ac099e82df3b8373663c03dcd2b9da431 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -2221,6 +2221,14 @@ static struct chan_iax2_pvt *new_iax(struct ast_sockaddr *addr, const char *host
                return NULL;
        }
 
+       tmp->pingid = -1;
+       tmp->lagid = -1;
+       tmp->autoid = -1;
+       tmp->authid = -1;
+       tmp->initid = -1;
+       tmp->keyrotateid = -1;
+       tmp->jbid = -1;
+
        if (ast_string_field_init(tmp, 32)) {
                ao2_ref(tmp, -1);
                tmp = NULL;
@@ -2228,18 +2236,11 @@ static struct chan_iax2_pvt *new_iax(struct ast_sockaddr *addr, const char *host
        }
 
        tmp->prefs = prefs_global;
-       tmp->pingid = -1;
-       tmp->lagid = -1;
-       tmp->autoid = -1;
-       tmp->authid = -1;
-       tmp->initid = -1;
-       tmp->keyrotateid = -1;
 
        ast_string_field_set(tmp,exten, "s");
        ast_string_field_set(tmp,host, host);
 
        tmp->jb = jb_new();
-       tmp->jbid = -1;
        jbconf.max_jitterbuf = maxjitterbuffer;
        jbconf.resync_threshold = resyncthreshold;
        jbconf.max_contig_interp = maxjitterinterps;

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 5f38e4dcc926fef5ce3e097094193ab130af7c77..c3e775de28feaa773e22f4d93d3eac83cf0f3e39 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -1706,6 +1706,7 @@ static int publish_expire(const void *data)
        ast_assert(esc != NULL);
 
        ao2_unlink(esc->compositor, esc_entry);
+       esc_entry->sched_id = -1;
        ao2_ref(esc_entry, -1);
        return 0;
 }
@@ -1738,6 +1739,11 @@ static struct sip_esc_entry *create_esc_entry(struct event_state_compositor *esc
        /* Bump refcount for scheduler */
        ao2_ref(esc_entry, +1);
        esc_entry->sched_id = ast_sched_add(sched, expires_ms, publish_expire, esc_entry);
+       if (esc_entry->sched_id == -1) {
+               ao2_ref(esc_entry, -1);
+               ao2_ref(esc_entry, -1);
+               return NULL;
+       }
 
        /* Note: This links the esc_entry into the ESC properly */
        create_new_sip_etag(esc_entry, 0);

diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index 499a7ef307a8fa5163287f69a10d9ad148d72415..b68a84d86c403965f2ca0fa1e1288c673751a448 100644 (file)
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -5560,12 +5560,12 @@ static void setsubstate(struct skinny_subchannel *sub, int state)
 
        skinny_locksub(sub);
 
-       if (sub->dialer_sched) {
+       if (-1 < sub->dialer_sched) {
                skinny_sched_del(sub->dialer_sched, sub);
                sub->dialer_sched = -1;
        }
 
-       if (state != SUBSTATE_RINGIN && sub->aa_sched) {
+       if (state != SUBSTATE_RINGIN && -1 < sub->aa_sched) {
                skinny_sched_del(sub->aa_sched, sub);
                sub->aa_sched = -1;
                sub->aa_beep = 0;
@@ -6250,7 +6250,7 @@ static int handle_keypad_button_message(struct skinny_req *req, struct skinnyses
        }
 
        if ((sub->owner && ast_channel_state(sub->owner) <  AST_STATE_UP)) {
-               if (sub->dialer_sched && !skinny_sched_del(sub->dialer_sched, sub)) {
+               if (-1 < sub->dialer_sched && !skinny_sched_del(sub->dialer_sched, sub)) {
                        SKINNY_DEBUG(DEBUG_SUB, 3, "Sub %u - Got a digit and not timed out, so try dialing\n", sub->callid);
                        sub->dialer_sched = -1;
                        len = strlen(sub->exten);
@@ -7087,7 +7087,7 @@ static int handle_soft_key_event_message(struct skinny_req *req, struct skinnyse
        case SOFTKEY_BKSPC:
                SKINNY_DEBUG(DEBUG_PACKET, 3, "Received SOFTKEY_BKSPC from %s, inst %d, callref %d\n",
                        d->name, instance, callreference);
-               if (sub->dialer_sched && !skinny_sched_del(sub->dialer_sched, sub)) {
+               if (-1 < sub->dialer_sched && !skinny_sched_del(sub->dialer_sched, sub)) {
                        size_t len;
                        sub->dialer_sched = -1;
                        len = strlen(sub->exten);

diff --git a/channels/sip/config_parser.c b/channels/sip/config_parser.c
index d48ff08dd022067a1b1318a92134c65ca6889594..50495427ed8c65769f0b85befbc94a728aaed850 100644 (file)
--- a/channels/sip/config_parser.c
+++ b/channels/sip/config_parser.c
@@ -79,13 +79,17 @@ int sip_parse_register_line(struct sip_registry *reg, int default_expiry, const
                AST_APP_ARG(port);
        );
 
-       if (!value) {
+       if (!reg) {
                return -1;
        }
 
-       if (!reg) {
+       reg->expire = -1;
+       reg->timeout = -1;
+
+       if (!value) {
                return -1;
        }
+
        ast_copy_string(buf, value, sizeof(buf));
 
        /*! register => [peer?][transport://]user[@domain][:secret[:authuser]]@host[:port][/extension][~expiry]
@@ -261,7 +265,6 @@ int sip_parse_register_line(struct sip_registry *reg, int default_expiry, const
        ast_string_field_set(reg, regdomain, ast_strip_quoted(S_OR(user2.domain, ""), "\"", "\""));
 
        reg->transport = transport;
-       reg->timeout = reg->expire = -1;
        reg->portno = portnum;
        reg->regdomainport = domainport;
        reg->callid_valid = FALSE;

diff --git a/main/channel.c b/main/channel.c
index 4c1b20660b0a45111d70ff8d416ed464ec4f4a05..6e5132f7bff516a731fd7717d20bf4696058f146 100644 (file)
--- a/main/channel.c
+++ b/main/channel.c
@@ -873,6 +873,7 @@ __ast_channel_alloc_ap(int needqueue, int state, const char *cid_num, const char
        ast_channel_hold_state_set(tmp, AST_CONTROL_UNHOLD);
 
        ast_channel_streamid_set(tmp, -1);
+       ast_channel_vstreamid_set(tmp, -1);
 
        ast_channel_fin_set(tmp, global_fin);
        ast_channel_fout_set(tmp, global_fout);

diff --git a/pbx/pbx_dundi.c b/pbx/pbx_dundi.c
index 097e4de23ce36e70441245914e022d02f3fd2086..5875aaecaf954fb55c31fcdb008f2f775fdadea2 100644 (file)
--- a/pbx/pbx_dundi.c
+++ b/pbx/pbx_dundi.c
@@ -3265,6 +3265,7 @@ static int dundi_send(struct dundi_transaction *trans, int cmdresp, int flags, i
        pack = ast_calloc(1, len);
        if (pack) {
                pack->h = (struct dundi_hdr *)(pack->data);
+               pack->retransid = -1;
                if (cmdresp != DUNDI_COMMAND_ACK) {
                        pack->retransid = ast_sched_add(sched, trans->retranstimer, dundi_rexmit, pack);
                        pack->retrans = DUNDI_DEFAULT_RETRANS - 1;