From: Filip Jenicek <phill@janevim.cz>
Date: Tue, 8 Dec 2015 07:57:22 +0000 (+0100)
Subject: chan_sip: Check sip_pvt pointer in ast_channel_get_t38_state(c)
X-Git-Tag: 14.0.0-beta1~528^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=59a91c350a48dcea7dc2bf1e22f5c2cef602772b;p=thirdparty%2Fasterisk.git

chan_sip: Check sip_pvt pointer in ast_channel_get_t38_state(c)

Asterisk may crash when calling ast_channel_get_t38_state(c)
on a locked channel which is being hung up.

ASTERISK-25609 #close

Change-Id: Ifaa707c04b865a290ffab719bd2e5c48ff667c7b
---

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index b2d61127fc..cd03e151a1 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -4757,6 +4757,11 @@ static int sip_queryoption(struct ast_channel *chan, int option, void *data, int
 	struct sip_pvt *p = (struct sip_pvt *) ast_channel_tech_pvt(chan);
 	char *cp;
 
+	if (!p) {
+		ast_debug(1, "Attempt to Ref a null pointer. Sip private structure is gone!\n");
+		return -1;
+	}
+
 	sip_pvt_lock(p);
 
 	switch (option) {