]> git.ipfire.org Git - thirdparty/asterisk.git/commitdiff
Fix dialplan function NULL channel safety issues
authorCorey Farrell <git@cfware.com>
Thu, 27 Mar 2014 19:06:13 +0000 (19:06 +0000)
committerCorey Farrell <git@cfware.com>
Thu, 27 Mar 2014 19:06:13 +0000 (19:06 +0000)
(closes issue ASTERISK-23391)
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/3386/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@411313 65c4cc65-6c06-0410-ace0-fbb531ad65f3

23 files changed:
apps/app_jack.c
apps/app_readexten.c
apps/app_speech_utils.c
apps/app_stack.c
channels/chan_iax2.c
channels/chan_sip.c
funcs/func_blacklist.c
funcs/func_callcompletion.c
funcs/func_callerid.c
funcs/func_channel.c
funcs/func_dialplan.c
funcs/func_frame_trace.c
funcs/func_global.c
funcs/func_groupcount.c
funcs/func_math.c
funcs/func_odbc.c
funcs/func_pitchshift.c
funcs/func_speex.c
funcs/func_strings.c
funcs/func_volume.c
res/res_calendar.c
res/res_jabber.c
res/res_mutestream.c

index 8b93956faa66b6db08258e19cebf89291fca2c26..928027379cc5a65a6c1f3acbf76eae23dd8e4d06 100644 (file)
@@ -951,6 +951,11 @@ static int jack_hook_write(struct ast_channel *chan, const char *cmd, char *data
 {
        int res;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (!strcasecmp(value, "on"))
                res = enable_jack_hook(chan, data);
        else if (!strcasecmp(value, "off"))
index 94dc1e1f87f3fd28416eeac285cd0c12414878d7..da7608c4b8be717ce5e65d190df3d528d91b0c99 100644 (file)
@@ -289,6 +289,11 @@ static int acf_isexten_exec(struct ast_channel *chan, const char *cmd, char *par
                AST_APP_ARG(priority);
        );
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        AST_STANDARD_APP_ARGS(args, parse);
 
        if (ast_strlen_zero(args.context))
index f9c6e14d1c35878a6227be36baa54a4a1d66093e..3785119f54bca8fb3d211115d5d85bc9cdf846ef 100644 (file)
@@ -284,7 +284,11 @@ static struct ast_speech *find_speech(struct ast_channel *chan)
 {
        struct ast_speech *speech = NULL;
        struct ast_datastore *datastore = NULL;
-       
+
+       if (!chan) {
+               return NULL;
+       }
+
        datastore = ast_channel_datastore_find(chan, &speech_datastore, NULL);
        if (datastore == NULL) {
                return NULL;
index 3118dfd7baf12471c1dba28116dac65386c7a147..4c8553c145229fded872484b335e4124c3403b09 100644 (file)
@@ -569,6 +569,11 @@ static int local_read(struct ast_channel *chan, const char *cmd, char *data, cha
        struct gosub_stack_frame *frame;
        struct ast_var_t *variables;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(stack_store = ast_channel_datastore_find(chan, &stack_info, NULL))) {
                ast_channel_unlock(chan);
@@ -603,6 +608,11 @@ static int local_write(struct ast_channel *chan, const char *cmd, char *var, con
        AST_LIST_HEAD(, gosub_stack_frame) *oldlist;
        struct gosub_stack_frame *frame;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(stack_store = ast_channel_datastore_find(chan, &stack_info, NULL))) {
                ast_log(LOG_ERROR, "Tried to set LOCAL(%s), but we aren't within a Gosub routine\n", var);
index a442d2c2a3b81165fe4c1aae5b2a6dd8ac049d76..02a5f8b1dad40daa0acd2221aca0378a4e49a655 100644 (file)
@@ -9936,10 +9936,17 @@ static int socket_process_meta(int packet_len, struct ast_iax2_meta_hdr *meta, s
 
 static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-       struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+       struct ast_datastore *variablestore;
        AST_LIST_HEAD(, ast_var_t) *varlist;
        struct ast_var_t *var;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
+       variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+
        if (!variablestore) {
                *buf = '\0';
                return 0;
@@ -9959,10 +9966,17 @@ static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data
 
 static int acf_iaxvar_write(struct ast_channel *chan, const char *cmd, char *data, const char *value)
 {
-       struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+       struct ast_datastore *variablestore;
        AST_LIST_HEAD(, ast_var_t) *varlist;
        struct ast_var_t *var;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
+       variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+
        if (!variablestore) {
                variablestore = ast_datastore_alloc(&iax2_variable_datastore_info, NULL);
                if (!variablestore) {
@@ -14127,8 +14141,9 @@ static int function_iaxpeer(struct ast_channel *chan, const char *cmd, char *dat
        /* if our channel, return the IP address of the endpoint of current channel */
        if (!strcmp(peername,"CURRENTCHANNEL")) {
                unsigned short callno;
-               if (chan->tech != &iax2_tech)
+               if (!chan || chan->tech != &iax2_tech) {
                        return -1;
+               }
                callno = PTR_TO_CALLNO(chan->tech_pvt); 
                ast_copy_string(buf, iaxs[callno]->addr.sin_addr.s_addr ? ast_inet_ntoa(iaxs[callno]->addr.sin_addr) : "", len);
                return 0;
index 8f01e9a407a55e1cf964af8d18703e51aae70748..af6982490b06a378fc5a720622e26fd57bc8c1db 100644 (file)
@@ -20120,7 +20120,12 @@ static int func_header_read(struct ast_channel *chan, const char *function, char
        );
        int i, number, start = 0;
 
-       if (ast_strlen_zero(data)) {
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+               return -1;
+       }
+
+       if (ast_strlen_zero(data)) {
                ast_log(LOG_WARNING, "This function requires a header name.\n");
                return -1;
        }
@@ -20293,8 +20298,13 @@ static int function_sipchaninfo_read(struct ast_channel *chan, const char *cmd,
        static int deprecated = 0;
 
        *buf = 0;
-       
-       if (!data) {
+
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
+       if (!data) {
                ast_log(LOG_WARNING, "This function requires a parameter name.\n");
                return -1;
        }
index be3bbc5fbd723a87b751fe0de0112c05cef4ace3..4348b019b7d3fe82713b502aa9106fea8c90485f 100644 (file)
@@ -61,6 +61,11 @@ static int blacklist_read(struct ast_channel *chan, const char *cmd, char *data,
        char blacklist[1];
        int bl = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (chan->caller.id.number.valid && chan->caller.id.number.str) {
                if (!ast_db_get("blacklist", chan->caller.id.number.str, blacklist, sizeof (blacklist)))
                        bl = 1;
index cee06faa47ad50edad2a1a85605ff3a4d55de757..cb1cd59b3f1f9d837c12cb4afb7b5cba983fd564 100644 (file)
@@ -74,6 +74,11 @@ static int acf_cc_read(struct ast_channel *chan, const char *name, char *data,
        struct ast_cc_config_params *cc_params;
        int res;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", name);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(cc_params = ast_channel_get_cc_config_params(chan))) {
                ast_channel_unlock(chan);
@@ -91,6 +96,11 @@ static int acf_cc_write(struct ast_channel *chan, const char *cmd, char *data,
        struct ast_cc_config_params *cc_params;
        int res;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(cc_params = ast_channel_get_cc_config_params(chan))) {
                ast_channel_unlock(chan);
index 1a3fc6f196f96218d686fff63ecb2184897822d0..1b14f1718ad609f090672fb2aa4b133473d307c1 100644 (file)
@@ -812,6 +812,11 @@ static int callerpres_deprecate_notify;
  */
 static int callerpres_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (!callerpres_deprecate_notify) {
                callerpres_deprecate_notify = 1;
                ast_log(LOG_WARNING, "CALLERPRES is deprecated."
@@ -838,6 +843,11 @@ static int callerpres_write(struct ast_channel *chan, const char *cmd, char *dat
 {
        int pres;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (!callerpres_deprecate_notify) {
                callerpres_deprecate_notify = 1;
                ast_log(LOG_WARNING, "CALLERPRES is deprecated."
index 7bca6bf7f99007d9823d84e7922f99096929714d..34d681bcbe14aec8182c9d6d459d8fe74a86772b 100644 (file)
@@ -338,6 +338,11 @@ static int func_channel_read(struct ast_channel *chan, const char *function,
 {
        int ret = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+               return -1;
+       }
+
        if (!strcasecmp(data, "audionativeformat"))
                /* use the _multiple version when chan->nativeformats holds multiple formats */
                /* ast_getformatname_multiple(buf, len, chan->nativeformats & AST_FORMAT_AUDIO_MASK); */
@@ -580,6 +585,11 @@ static int func_channel_write(struct ast_channel *chan, const char *function, ch
                .value = value,
        };
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+               return -1;
+       }
+
        res = func_channel_write_real(chan, function, data, value);
        ast_channel_setoption(chan, AST_OPTION_CHANNEL_WRITE, &write_info, sizeof(write_info), 0);
 
@@ -653,8 +663,15 @@ static struct ast_custom_function channels_function = {
 static int func_mchan_read(struct ast_channel *chan, const char *function,
                             char *data, struct ast_str **buf, ssize_t len)
 {
-       struct ast_channel *mchan = ast_channel_get_by_name(chan->linkedid);
+       struct ast_channel *mchan;
        char *template = ast_alloca(4 + strlen(data));
+
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+               return -1;
+       }
+
+       mchan = ast_channel_get_by_name(chan->linkedid);
        sprintf(template, "${%s}", data); /* SAFE */
        ast_str_substitute_variables(buf, len, mchan ? mchan : chan, template);
        if (mchan) {
@@ -666,7 +683,14 @@ static int func_mchan_read(struct ast_channel *chan, const char *function,
 static int func_mchan_write(struct ast_channel *chan, const char *function,
                              char *data, const char *value)
 {
-       struct ast_channel *mchan = ast_channel_get_by_name(chan->linkedid);
+       struct ast_channel *mchan;
+
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+               return -1;
+       }
+
+       mchan = ast_channel_get_by_name(chan->linkedid);
        pbx_builtin_setvar_helper(mchan ? mchan : chan, data, value);
        if (mchan) {
                ast_channel_unref(mchan);
index 372ee613fb8a3ba7cdc98fe912e0174395d20c02..6e87628f743718d306179788841debb968485e61 100644 (file)
@@ -78,20 +78,23 @@ static int isexten_function_read(struct ast_channel *chan, const char *cmd, char
                int priority_num;
                if (sscanf(args.priority, "%30d", &priority_num) == 1 && priority_num > 0) {
                        int res;
-                       res = ast_exists_extension(chan, args.context, args.exten, priority_num, 
+                       res = ast_exists_extension(chan, args.context, args.exten, priority_num,
+                               !chan ? NULL :
                                S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL));
                        if (res)
                                strcpy(buf, "1");
                } else {
                        int res;
                        res = ast_findlabel_extension(chan, args.context, args.exten, args.priority,
+                               !chan ? NULL :
                                S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL));
                        if (res > 0)
                                strcpy(buf, "1");
                }
        } else if (!ast_strlen_zero(args.exten)) {
                int res;
-               res = ast_exists_extension(chan, args.context, args.exten, 1, 
+               res = ast_exists_extension(chan, args.context, args.exten, 1,
+                       !chan ? NULL :
                        S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL));
                if (res)
                        strcpy(buf, "1");
index 0c1bc81cf6866b74c6fd41dd7419de91c3111b6b..9b2785e322bdbf2c5acd3c60803d37ba6b46a0bb 100644 (file)
@@ -157,6 +157,11 @@ static int frame_trace_helper(struct ast_channel *chan, const char *cmd, char *d
        };
        int i = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (!(framedata = ast_calloc(1, sizeof(*framedata)))) {
                return 0;
        }
index 66b04a97bc91adeee62544ff3702fb2ad6f86d89..c84374fdc8725427b870cb77815d4be06514401c 100644 (file)
@@ -155,6 +155,9 @@ static int shared_read(struct ast_channel *chan, const char *cmd, char *data, ch
                        return -1;
                }
                chan = c_ref;
+       } else if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
        }
 
        ast_channel_lock(chan);
@@ -213,6 +216,9 @@ static int shared_write(struct ast_channel *chan, const char *cmd, char *data, c
                        return -1;
                }
                chan = c_ref;
+       } else if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
        }
 
        ast_channel_lock(chan);
index 609d01fefae5f6359f77ada0e2d67bee0c238560..5ebd723def7cb248649a40809e672484ed020939 100644 (file)
@@ -104,6 +104,11 @@ static int group_count_function_read(struct ast_channel *chan, const char *cmd,
        int count = -1;
        char group[80] = "", category[80] = "";
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_app_group_split_group(data, group, sizeof(group), category,
                                  sizeof(category));
 
@@ -174,9 +179,14 @@ static int group_function_read(struct ast_channel *chan, const char *cmd,
 {
        int ret = -1;
        struct ast_group_info *gi = NULL;
-       
+
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_app_group_list_rdlock();
-       
+
        for (gi = ast_app_group_list_head(); gi; gi = AST_LIST_NEXT(gi, group_list)) {
                if (gi->chan != chan)
                        continue;
@@ -201,6 +211,11 @@ static int group_function_write(struct ast_channel *chan, const char *cmd,
 {
        char grpcat[256];
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (!value) {
                return -1;
        }
index 36f3fc48a6848f32253900bee8e7d4b88e6c4175..2bc68c579a8ea9aab86b2d88f8b151349fccc41a 100644 (file)
@@ -392,6 +392,11 @@ static int crement_function_read(struct ast_channel *chan, const char *cmd,
                return -1;
        }
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
 
        if (!(var = pbx_builtin_getvar_helper(chan, data))) {
index b8e60b495b326e642e57cb24c27c4e8e5cfbcc66..ee6384c7cd465b41241e795a56e23aea4370e492 100644 (file)
@@ -801,6 +801,11 @@ static int acf_fetch(struct ast_channel *chan, const char *cmd, char *data, char
        struct odbc_datastore *resultset;
        struct odbc_datastore_row *row;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        store = ast_channel_datastore_find(chan, &odbc_info, data);
        if (!store) {
index 1b4e7fb1b67f70deed9cb6a72de3c8bb23f12655..82410674c7aee203783226ebe328d2f65692141b 100644 (file)
@@ -201,6 +201,11 @@ static int pitchshift_helper(struct ast_channel *chan, const char *cmd, char *da
        int new = 0;
        float amount = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(datastore = ast_channel_datastore_find(chan, &pitchshift_datastore, NULL))) {
                ast_channel_unlock(chan);
index 86ea82b0926be7ea25f741526bf02ea44e5f660f..0a716d7bfd5ab92178cd4759b2731b0b256b0270 100644 (file)
@@ -200,6 +200,11 @@ static int speex_write(struct ast_channel *chan, const char *cmd, char *data, co
        struct speex_direction_info **sdi = NULL;
        int is_new = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (strcasecmp(data, "rx") && strcasecmp(data, "tx")) {
                ast_log(LOG_ERROR, "Invalid argument provided to the %s function\n", cmd);
                return -1;
index 5ac19305ebb547d03112b0d20f3553d0fc54ba2b..767ea225b82a69c26d0a50b32d48644cf3678736 100644 (file)
@@ -990,6 +990,11 @@ static int hashkeys_read(struct ast_channel *chan, const char *cmd, char *data,
        struct ast_var_t *newvar;
        struct ast_str *prefix = ast_str_alloca(80);
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_str_set(&prefix, -1, HASH_PREFIX, data);
        memset(buf, 0, len);
 
@@ -1012,6 +1017,11 @@ static int hashkeys_read2(struct ast_channel *chan, const char *cmd, char *data,
        struct ast_str *prefix = ast_str_alloca(80);
        char *tmp;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_str_set(&prefix, -1, HASH_PREFIX, data);
 
        AST_LIST_TRAVERSE(&chan->varshead, newvar, entries) {
@@ -1081,6 +1091,11 @@ static int hash_read(struct ast_channel *chan, const char *cmd, char *data, char
                        AST_APP_ARG(col)[100];
                );
 
+               if (!chan) {
+                       ast_log(LOG_WARNING, "No channel and only 1 parameter was provided to %s function.\n", cmd);
+                       return -1;
+               }
+
                /* Get column names, in no particular order */
                hashkeys_read(chan, "HASHKEYS", arg.hashname, colnames, sizeof(colnames));
                pbx_builtin_setvar_helper(chan, "~ODBCFIELDS~", colnames);
index 6080bc442b10b164c847b454900c05d15296aa70..bf169fecc61e64d752ba0d8bd4c5d97e232d25f7 100644 (file)
@@ -156,12 +156,17 @@ static int volume_write(struct ast_channel *chan, const char *cmd, char *data, c
        int is_new = 0;
 
        /* Separate options from argument */
-       
+
        AST_DECLARE_APP_ARGS(args,
                AST_APP_ARG(direction);
                AST_APP_ARG(options);
        );
-       
+
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        AST_STANDARD_APP_ARGS(args, data);
 
        ast_channel_lock(chan);
index 6e509d73473db6a41aec1d275a142dcae85763e6..a28700b5c228f2ad20567900dcadbe9016b806d5 100644 (file)
@@ -1585,6 +1585,11 @@ static int calendar_event_read(struct ast_channel *chan, const char *cmd, char *
        struct ast_datastore *datastore;
        struct ast_calendar_event *event;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        if (ast_strlen_zero(data)) {
                ast_log(LOG_WARNING, "%s requires an argument\n", cmd);
                return -1;
index 1dc3bf73c4116f7c62e2150fec3fd583a7c462d6..bd3763ba59539b08221a4f8e66ebf13f86b6c85e 100644 (file)
@@ -827,7 +827,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch
 
        start = ast_tvnow();
 
-       if (ast_autoservice_start(chan) < 0) {
+       if (chan && ast_autoservice_start(chan) < 0) {
                ast_log(LOG_WARNING, "Cannot start autoservice for channel %s\n", chan->name);
                ASTOBJ_UNREF(client, ast_aji_client_destroy);
                return -1;
@@ -899,7 +899,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch
        }
 
        ASTOBJ_UNREF(client, ast_aji_client_destroy);
-       if (ast_autoservice_stop(chan) < 0) {
+       if (chan && ast_autoservice_stop(chan) < 0) {
                ast_log(LOG_WARNING, "Cannot stop autoservice for channel %s\n", chan->name);
        }
 
index 000a7fb3dad7eb49a245c9209a78760c1b9ac4b0..bdc872671a3f552dabe96c5c6aa92d9d7ac44c51 100644 (file)
@@ -206,6 +206,11 @@ static int func_mute_write(struct ast_channel *chan, const char *cmd, char *data
        struct mute_information *mute = NULL;
        int is_new = 0;
 
+       if (!chan) {
+               ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+               return -1;
+       }
+
        ast_channel_lock(chan);
        if (!(datastore = ast_channel_datastore_find(chan, &mute_datastore, NULL))) {
                if (!(datastore = initialize_mutehook(chan))) {