From: Mark Lipscombe <mlipscombe@gmail.com>
Date: Wed, 4 Nov 2015 06:33:11 +0000 (+1100)
Subject: FS-8413: Segfault calling session:getVariable(nil) in lua script
X-Git-Tag: v1.4.26~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6d8edab59b9e9cc2aeb0b2d864f9cb4280b181a2;p=thirdparty%2Ffreeswitch.git

FS-8413: Segfault calling session:getVariable(nil) in lua script

script calling session:getVariable() with a null variable
name will cause FreeSWITCH to segfault.

This change checks whether varname parameter to
switch_channel_get_variable_dup is non-NULL.
---

diff --git a/src/switch_channel.c b/src/switch_channel.c
index a56a2eeb87..b9aa1d71fc 100644
--- a/src/switch_channel.c
+++ b/src/switch_channel.c
@@ -930,32 +930,34 @@ SWITCH_DECLARE(const char *) switch_channel_get_variable_dup(switch_channel_t *c
 
 	switch_mutex_lock(channel->profile_mutex);
 
-	if (channel->scope_variables) {
-		switch_event_t *ep;
+	if (!zstr(varname)) {
+		if (channel->scope_variables) {
+			switch_event_t *ep;
 
-		for (ep = channel->scope_variables; ep; ep = ep->next) {
-			if ((v = switch_event_get_header_idx(ep, varname, idx))) {
-				break;
+			for (ep = channel->scope_variables; ep; ep = ep->next) {
+				if ((v = switch_event_get_header_idx(ep, varname, idx))) {
+					break;
+				}
 			}
 		}
-	}
 
-	if (!v && (!channel->variables || !(v = switch_event_get_header_idx(channel->variables, varname, idx)))) {
-		switch_caller_profile_t *cp = switch_channel_get_caller_profile(channel);
+		if (!v && (!channel->variables || !(v = switch_event_get_header_idx(channel->variables, varname, idx)))) {
+			switch_caller_profile_t *cp = switch_channel_get_caller_profile(channel);
 
-		if (cp) {
-			if (!strncmp(varname, "aleg_", 5)) {
-				cp = cp->originator_caller_profile;
-				varname += 5;
-			} else if (!strncmp(varname, "bleg_", 5)) {
-				cp = cp->originatee_caller_profile;
-				varname += 5;
+			if (cp) {
+				if (!strncmp(varname, "aleg_", 5)) {
+					cp = cp->originator_caller_profile;
+					varname += 5;
+				} else if (!strncmp(varname, "bleg_", 5)) {
+					cp = cp->originatee_caller_profile;
+					varname += 5;
+				}
 			}
-		}
 
-		if (!cp || !(v = switch_caller_get_field_by_name(cp, varname))) {
-			if ((vdup = switch_core_get_variable_pdup(varname, switch_core_session_get_pool(channel->session)))) {
-				v = vdup;
+			if (!cp || !(v = switch_caller_get_field_by_name(cp, varname))) {
+				if ((vdup = switch_core_get_variable_pdup(varname, switch_core_session_get_pool(channel->session)))) {
+					v = vdup;
+				}
 			}
 		}
 	}