From: David Vossel Date: Thu, 23 Jun 2011 18:23:21 +0000 (+0000) Subject: Merged revisions 324634 via svnmerge from X-Git-Tag: 1.8.5-rc1~11^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1adc7cefa15079b3469936261f588add0953ea7;p=thirdparty%2Fasterisk.git Merged revisions 324634 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.6.2 ................ r324634 | dvossel | 2011-06-23 13:18:46 -0500 (Thu, 23 Jun 2011) | 13 lines Merged revisions 324627 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r324627 | dvossel | 2011-06-23 13:16:52 -0500 (Thu, 23 Jun 2011) | 7 lines Addresses AST-2011-010, remote crash in IAX2 driver Thanks to twilson for identifying the issue and providing the patches. AST-2011-010 ........ ................ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@324652 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 86ef7052d5..3505dc18e9 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -5266,10 +5266,6 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat /* these two cannot be sent, because they require a result */ errno = ENOSYS; return -1; - case AST_OPTION_FORMAT_READ: - case AST_OPTION_FORMAT_WRITE: - case AST_OPTION_MAKE_COMPATIBLE: - return -1; case AST_OPTION_OPRMODE: errno = EINVAL; return -1; @@ -5286,7 +5282,16 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat ast_mutex_unlock(&iaxsl[callno]); return 0; } - default: + /* These options are sent to the other side across the network where + * they will be passed to whatever channel is bridged there. Don't + * do anything silly like pass an option that transmits pointers to + * memory on this machine to a remote machine to use */ + case AST_OPTION_TONE_VERIFY: + case AST_OPTION_TDD: + case AST_OPTION_RELAXDTMF: + case AST_OPTION_AUDIO_MODE: + case AST_OPTION_DIGIT_DETECT: + case AST_OPTION_FAX_DETECT: { unsigned short callno = PTR_TO_CALLNO(c->tech_pvt); struct chan_iax2_pvt *pvt; @@ -5314,7 +5319,12 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat ast_free(h); return res; } + default: + return -1; } + + /* Just in case someone does a break instead of a return */ + return -1; } static int iax2_queryoption(struct ast_channel *c, int option, void *data, int *datalen) diff --git a/include/asterisk/frame.h b/include/asterisk/frame.h index f3f1f3a12a..15ffdb8561 100644 --- a/include/asterisk/frame.h +++ b/include/asterisk/frame.h @@ -404,45 +404,51 @@ enum ast_control_transfer { #define AST_OPTION_FLAG_WTF 6 /*! Verify touchtones by muting audio transmission - (and reception) and verify the tone is still present */ + * (and reception) and verify the tone is still present + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_TONE_VERIFY 1 -/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode */ +/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_TDD 2 -/*! Relax the parameters for DTMF reception (mainly for radio use) */ +/*! Relax the parameters for DTMF reception (mainly for radio use) + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_RELAXDTMF 3 -/*! Set (or clear) Audio (Not-Clear) Mode */ +/*! Set (or clear) Audio (Not-Clear) Mode + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_AUDIO_MODE 4 /*! Set channel transmit gain - * Option data is a single signed char - representing number of decibels (dB) - to set gain to (on top of any gain - specified in channel driver) -*/ + * Option data is a single signed char representing number of decibels (dB) + * to set gain to (on top of any gain specified in channel driver) */ #define AST_OPTION_TXGAIN 5 /*! Set channel receive gain - * Option data is a single signed char - representing number of decibels (dB) - to set gain to (on top of any gain - specified in channel driver) -*/ + * Option data is a single signed char representing number of decibels (dB) + * to set gain to (on top of any gain specified in channel driver) */ #define AST_OPTION_RXGAIN 6 -/* set channel into "Operator Services" mode */ +/* set channel into "Operator Services" mode + * Option data is a struct oprmode + * + * \note This option should never be sent over the network */ #define AST_OPTION_OPRMODE 7 -/*! Explicitly enable or disable echo cancelation for the given channel */ +/*! Explicitly enable or disable echo cancelation for the given channel + * Option data is a single signed char value 0 or 1 + * + * \note This option appears to be unused in the code. It is handled, but never + * set or queried. */ #define AST_OPTION_ECHOCAN 8 /*! \brief Handle channel write data * If a channel needs to process the data from a func_channel write operation * after func_channel_write executes, it can define the setoption callback * and process this option. A pointer to an ast_chan_write_info_t will be passed. - * */ + * + * \note This option should never be passed over the network. */ #define AST_OPTION_CHANNEL_WRITE 9 /* ! @@ -451,28 +457,38 @@ enum ast_control_transfer { */ #define AST_OPTION_T38_STATE 10 -/*! Request that the channel driver deliver frames in a specific format */ +/*! Request that the channel driver deliver frames in a specific format + * Option data is a format_t */ #define AST_OPTION_FORMAT_READ 11 -/*! Request that the channel driver be prepared to accept frames in a specific format */ +/*! Request that the channel driver be prepared to accept frames in a specific format + * Option data is a format_t */ #define AST_OPTION_FORMAT_WRITE 12 -/*! Request that the channel driver make two channels of the same tech type compatible if possible */ +/*! Request that the channel driver make two channels of the same tech type compatible if possible + * Option data is an ast_channel + * + * \note This option should never be passed over the network */ #define AST_OPTION_MAKE_COMPATIBLE 13 -/*! Get or set the digit detection state of the channel */ +/*! Get or set the digit detection state of the channel + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_DIGIT_DETECT 14 -/*! Get or set the fax tone detection state of the channel */ +/*! Get or set the fax tone detection state of the channel + * Option data is a single signed char value 0 or 1 */ #define AST_OPTION_FAX_DETECT 15 -/*! Get the device name from the channel */ +/*! Get the device name from the channel (Read only) + * Option data is a character buffer of suitable length */ #define AST_OPTION_DEVICE_NAME 16 -/*! Get the CC agent type from the channel */ +/*! Get the CC agent type from the channel (Read only) + * Option data is a character buffer of suitable length */ #define AST_OPTION_CC_AGENT_TYPE 17 -/*! Get or set the security options on a channel */ +/*! Get or set the security options on a channel + * Option data is an integer value of 0 or 1 */ #define AST_OPTION_SECURE_SIGNALING 18 #define AST_OPTION_SECURE_MEDIA 19 diff --git a/main/features.c b/main/features.c index 7a8fa32fed..f1b788a2b6 100644 --- a/main/features.c +++ b/main/features.c @@ -3707,10 +3707,21 @@ int ast_bridge_call(struct ast_channel *chan,struct ast_channel *peer,struct ast break; case AST_CONTROL_OPTION: aoh = f->data.ptr; - /* Forward option Requests */ + /* Forward option Requests, but only ones we know are safe + * These are ONLY sent by chan_iax2 and I'm not convinced that + * they are useful. I haven't deleted them entirely because I + * just am not sure of the ramifications of removing them. */ if (aoh && aoh->flag == AST_OPTION_FLAG_REQUEST) { - ast_channel_setoption(other, ntohs(aoh->option), aoh->data, - f->datalen - sizeof(struct ast_option_header), 0); + switch (ntohs(aoh->option)) { + case AST_OPTION_TONE_VERIFY: + case AST_OPTION_TDD: + case AST_OPTION_RELAXDTMF: + case AST_OPTION_AUDIO_MODE: + case AST_OPTION_DIGIT_DETECT: + case AST_OPTION_FAX_DETECT: + ast_channel_setoption(other, ntohs(aoh->option), aoh->data, + f->datalen - sizeof(struct ast_option_header), 0); + } } break; }