From: Jeff Peeler <jpeeler@digium.com>
Date: Tue, 1 Dec 2009 21:57:45 +0000 (+0000)
Subject: Merged revisions 231927 via svnmerge from
X-Git-Tag: 1.6.0.20-rc1~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=69807342eadbcb903ed965d794b510c6678bfb4d;p=thirdparty%2Fasterisk.git

Merged revisions 231927 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
  r231927 | jpeeler | 2009-12-01 15:54:21 -0600 (Tue, 01 Dec 2009) | 19 lines

  Merged revisions 231911 via svnmerge from
  https://origsvn.digium.com/svn/asterisk/branches/1.4

  ........
    r231911 | jpeeler | 2009-12-01 15:29:31 -0600 (Tue, 01 Dec 2009) | 12 lines

    Fix crash with invalid frame data

    The crash was happening as a result of a frame containing an invalid data
    pointer, but was set with data length of zero. The few times the issue was
    reproduced it _seemed_ that the frame was queued properly, that is the data
    pointer was set to NULL. I never could reproduce the crash so as a last resort
    the crash has been fixed, but a check in __ast_read has been added to give as
    much information about the source of problematic frames in the future.

    (closes issue #16058)
    Reported by: atis
  ........
................


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.0@231928 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/channel.c b/main/channel.c
index ceb8611812..58eac2a85e 100644
--- a/main/channel.c
+++ b/main/channel.c
@@ -3018,6 +3018,17 @@ static struct ast_frame *__ast_read(struct ast_channel *chan, int dropaudio)
 		ast_frame_dump(chan->name, f, "<<");
 	chan->fin = FRAMECOUNT_INC(chan->fin);
 
+	if (f && f->datalen == 0 && f->data) {
+		/* fix invalid pointer */
+		f->data = NULL;
+#ifdef AST_DEVMODE
+		ast_log(LOG_ERROR, "Found frame with src '%s' on channel '%s' with datalen zero, but non-null data pointer!\n", f->src, chan->name);
+		ast_frame_dump(chan->name, f, "<<");
+#else
+		ast_debug(3, "Found frame with src '%s' on channel '%s' with datalen zero, but non-null data pointer!\n", f->src, chan->name);
+#endif
+	}
+
 done:
 	if (chan->music_state && chan->generator && chan->generator->digit && f && f->frametype == AST_FRAME_DTMF_END)
 		chan->generator->digit(chan, f->subclass);