From c00ab8a6edc32f3db663a4539d7efda74cf2ac39 Mon Sep 17 00:00:00 2001
From: Richard Mudgett <rmudgett@digium.com>
Date: Thu, 11 Aug 2011 21:39:58 +0000
Subject: [PATCH] Segfault in shell_helper in func_shell.c.

The return value of popen() was not checked for failure to open.

(closes issue ASTERISK-18109)
JIRA SWP-3633
Reported by: Michael Myles
Tested by: rmudgett


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@331575 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 funcs/func_shell.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/funcs/func_shell.c b/funcs/func_shell.c
index 1f274b83d5..2f34f62ab8 100644
--- a/funcs/func_shell.c
+++ b/funcs/func_shell.c
@@ -42,29 +42,38 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 static int shell_helper(struct ast_channel *chan, const char *cmd, char *data,
 		                         char *buf, size_t len)
 {
+	int res = 0;
+
 	if (ast_strlen_zero(data)) {
 		ast_log(LOG_WARNING, "Missing Argument!  Example:  Set(foo=${SHELL(echo \"bar\")})\n");
 		return -1;
 	}
 
-	if (chan)
+	if (chan) {
 		ast_autoservice_start(chan);
+	}
 
 	if (len >= 1) {
 		FILE *ptr;
 		char plbuff[4096];
 
 		ptr = popen(data, "r");
-		while (fgets(plbuff, sizeof(plbuff), ptr)) {
-			strncat(buf, plbuff, len - strlen(buf) - 1);
+		if (ptr) {
+			while (fgets(plbuff, sizeof(plbuff), ptr)) {
+				strncat(buf, plbuff, len - strlen(buf) - 1);
+			}
+			pclose(ptr);
+		} else {
+			ast_log(LOG_WARNING, "Failed to execute shell command '%s'\n", data);
+			res = -1;
 		}
-		pclose(ptr);
 	}
 
-	if (chan)
+	if (chan) {
 		ast_autoservice_stop(chan);
+	}
 
-	return 0;
+	return res;
 }
 
 /*** DOCUMENTATION
-- 
2.47.2