Ensure that a destination callno of 0 will not match for frames that do not

start a dialog (new, lagrq, and ping).
(closes issue #12963)
 Reported by: russellb
 Patches:
       chan_iax2_dup_new_fix4.patch uploaded by jpgrayson (license 492)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@130169 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 8c2c6187e9b79bd5401a5b36af972b7b924ec4d9..a6f8e9824a616743e56ee4f56e9e2bbbbfdf9cf7 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -7191,12 +7191,21 @@ static int socket_process(struct iax2_thread *thread)
                 * Discussed in the following thread:
                 * http://lists.digium.com/pipermail/asterisk-dev/2008-May/033217.html 
                 */
-               if (f.frametype != AST_FRAME_IAX ||
-                               (f.subclass != IAX_COMMAND_NEW &&
-                                f.subclass != IAX_COMMAND_PING &&
-                                f.subclass != IAX_COMMAND_LAGRQ)) {
-                       /* Get the destination call number */
-                       dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
+
+               /* Get the destination call number */
+               dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
+
+               if (f.frametype == AST_FRAME_IAX &&
+                               (f.subclass == IAX_COMMAND_NEW ||
+                                f.subclass == IAX_COMMAND_PING ||
+                                f.subclass == IAX_COMMAND_LAGRQ)) {
+                       dcallno = 0;
+               } else if (!dcallno) {
+                       /* All other full-frames must have a non-zero dcallno,
+                        * We silently drop this frame since it cannot be a
+                        * valid match to an existing call session.
+                        */
+                       return 1;
                }
                if ((f.frametype == AST_FRAME_IAX) && ((f.subclass == IAX_COMMAND_NEW) || (f.subclass == IAX_COMMAND_REGREQ) ||
                                                       (f.subclass == IAX_COMMAND_POKE) || (f.subclass == IAX_COMMAND_FWDOWNL) ||