From: Kinsey Moore <kmoore@digium.com>
Date: Tue, 12 Nov 2013 15:02:18 +0000 (+0000)
Subject: chan_dahdi: Fix crash during caller ID read
X-Git-Tag: 12.0.0-beta2~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=192732b83df99d930c7e6dbb4d6b1e25978e68ab;p=thirdparty%2Fasterisk.git

chan_dahdi: Fix crash during caller ID read

Asterisk will sometimes core dump during caller id read on analog
channels due to a negative return value from the read() in
my_get_callerid that slips through as a negative length argument to
callerid_feed() if the errno returned by DAHDI is ELAST. This change
ensures that the negative return is treated properly even when it is
ELAST.

(closes issue ASTERISK-22746)
Reported by: Michael Walton
Patches:
    chan_dahdi_cid_crash_fix.r401410.patch uploaded by Michael Walton (License 6502)
........

Merged revisions 402708 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 402709 from http://svn.asterisk.org/svn/asterisk/branches/11


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@402710 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 10949d3354..8039a90bdb 100644
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -1219,11 +1219,8 @@ static int my_get_callerid(void *pvt, char *namebuf, char *numbuf, enum analog_e
 		 * a failure and die, and returning 2 means no event was received. */
 		res = read(p->subs[index].dfd, buf, sizeof(buf));
 		if (res < 0) {
-			if (errno != ELAST) {
-				ast_log(LOG_WARNING, "read returned error: %s\n", strerror(errno));
-				callerid_free(p->cs);
-				return -1;
-			}
+			ast_log(LOG_WARNING, "read returned error: %s\n", strerror(errno));
+			return -1;
 		}
 
 		if (analog_p->ringt > 0) {