From: Richard Mudgett <rmudgett@digium.com>
Date: Wed, 4 Jan 2012 20:46:20 +0000 (+0000)
Subject: Fix segfault in chan_dahdi for CHANNEL(dahdi_span) evaluation on hangup.
X-Git-Tag: 1.8.10.0-rc1~79
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f7d995edc12d511b612ef47dabc54ce05ea3a83;p=thirdparty%2Fasterisk.git

Fix segfault in chan_dahdi for CHANNEL(dahdi_span) evaluation on hangup.

* Added NULL private pointer checks in the following chan_dahdi channel
callbacks: dahdi_func_read(), dahdi_func_write(), dahdi_setoption(), and
dahdi_queryoption().

(closes issue ASTERISK-19142)
Reported by: Diego Aguirre
Tested by: rmudgett


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@349558 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 808e95ac00..4545430108 100644
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -6588,7 +6588,7 @@ static int dahdi_queryoption(struct ast_channel *chan, int option, void *data, i
 	struct dahdi_pvt *p = chan->tech_pvt;
 
 	/* all supported options require data */
-	if (!data || (*datalen < 1)) {
+	if (!p || !data || (*datalen < 1)) {
 		errno = EINVAL;
 		return -1;
 	}
@@ -6634,7 +6634,7 @@ static int dahdi_setoption(struct ast_channel *chan, int option, void *data, int
 
 
 	/* all supported options require data */
-	if (!data || (datalen < 1)) {
+	if (!p || !data || (datalen < 1)) {
 		errno = EINVAL;
 		return -1;
 	}
@@ -6847,6 +6847,12 @@ static int dahdi_func_read(struct ast_channel *chan, const char *function, char
 	struct dahdi_pvt *p = chan->tech_pvt;
 	int res = 0;
 
+	if (!p) {
+		/* No private structure! */
+		*buf = '\0';
+		return -1;
+	}
+
 	if (!strcasecmp(data, "rxgain")) {
 		ast_mutex_lock(&p->lock);
 		snprintf(buf, len, "%f", p->rxgain);
@@ -6980,6 +6986,11 @@ static int dahdi_func_write(struct ast_channel *chan, const char *function, char
 	struct dahdi_pvt *p = chan->tech_pvt;
 	int res = 0;
 
+	if (!p) {
+		/* No private structure! */
+		return -1;
+	}
+
 	if (!strcasecmp(data, "buffers")) {
 		int num_bufs, policy;