From: Richard Mudgett <rmudgett@digium.com>
Date: Thu, 21 Jun 2018 21:39:45 +0000 (-0500)
Subject: VECTOR: Passing parameters with side effects to macros is dangerous.
X-Git-Tag: 13.22.0-rc1~10^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cb9475eb3d5ee3a305f6490e6eb8bb36ce054713;p=thirdparty%2Fasterisk.git

VECTOR: Passing parameters with side effects to macros is dangerous.

* Fix several instances where we were bumping a ref in the parameter and
then unrefing the object if it failed.  The way the AST_VECTOR_APPEND()
and AST_VECTOR_REPLACE() macros are implemented means if it fails the new
value was never evaluated.

Change-Id: I2847872a455b11ea7e5b7ce697c0a455a1d0ac9a
---

diff --git a/res/res_pjsip/pjsip_options.c b/res/res_pjsip/pjsip_options.c
index 2229664cc4..891de899cf 100644
--- a/res/res_pjsip/pjsip_options.c
+++ b/res/res_pjsip/pjsip_options.c
@@ -1530,10 +1530,11 @@ static int sip_options_endpoint_compositor_add_task(void *obj)
 	ast_debug(3, "Adding endpoint compositor '%s' to AOR '%s'\n",
 		task_data->endpoint_state_compositor->name, task_data->aor_options->name);
 
+	ao2_ref(task_data->endpoint_state_compositor, +1);
 	if (AST_VECTOR_APPEND(&task_data->aor_options->compositors,
-		ao2_bump(task_data->endpoint_state_compositor))) {
+		task_data->endpoint_state_compositor)) {
 		/* Failed to add so no need to update the endpoint status.  Nothing changed. */
-		ao2_cleanup(task_data->endpoint_state_compositor);
+		ao2_ref(task_data->endpoint_state_compositor, -1);
 		return 0;
 	}
 
diff --git a/res/res_pjsip_history.c b/res/res_pjsip_history.c
index 8f44d390e7..e6e9ac200b 100644
--- a/res/res_pjsip_history.c
+++ b/res/res_pjsip_history.c
@@ -1135,7 +1135,8 @@ static struct vector_history_t *filter_history(struct ast_cli_args *a)
 		} else if (!res) {
 			continue;
 		} else {
-			if (AST_VECTOR_APPEND(output, ao2_bump(entry))) {
+			ao2_bump(entry);
+			if (AST_VECTOR_APPEND(output, entry)) {
 				ao2_cleanup(entry);
 			}
 		}
diff --git a/res/stasis/messaging.c b/res/stasis/messaging.c
index 979b687abd..4a86d58755 100644
--- a/res/stasis/messaging.c
+++ b/res/stasis/messaging.c
@@ -459,8 +459,9 @@ static struct message_subscription *get_or_create_subscription(struct ast_endpoi
 		ao2_link(endpoint_subscriptions, sub);
 	} else {
 		ast_rwlock_wrlock(&tech_subscriptions_lock);
-		if (AST_VECTOR_APPEND(&tech_subscriptions, ao2_bump(sub))) {
-			/* Release the ao2_bump that was for the vector and allocation references. */
+		ao2_ref(sub, +1);
+		if (AST_VECTOR_APPEND(&tech_subscriptions, sub)) {
+			/* Release the refs that were for the vector and the allocation. */
 			ao2_ref(sub, -2);
 			sub = NULL;
 		}