From: Corey Farrell Date: Thu, 27 Mar 2014 19:06:13 +0000 (+0000) Subject: Fix dialplan function NULL channel safety issues X-Git-Tag: 1.8.27.0-rc1~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=824c8d4b6bed90fbfe47722799fdcdd99c433916;p=thirdparty%2Fasterisk.git Fix dialplan function NULL channel safety issues (closes issue ASTERISK-23391) Reported by: Corey Farrell Review: https://reviewboard.asterisk.org/r/3386/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@411313 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- diff --git a/apps/app_jack.c b/apps/app_jack.c index 8b93956faa..928027379c 100644 --- a/apps/app_jack.c +++ b/apps/app_jack.c @@ -951,6 +951,11 @@ static int jack_hook_write(struct ast_channel *chan, const char *cmd, char *data { int res; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (!strcasecmp(value, "on")) res = enable_jack_hook(chan, data); else if (!strcasecmp(value, "off")) diff --git a/apps/app_readexten.c b/apps/app_readexten.c index 94dc1e1f87..da7608c4b8 100644 --- a/apps/app_readexten.c +++ b/apps/app_readexten.c @@ -289,6 +289,11 @@ static int acf_isexten_exec(struct ast_channel *chan, const char *cmd, char *par AST_APP_ARG(priority); ); + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + AST_STANDARD_APP_ARGS(args, parse); if (ast_strlen_zero(args.context)) diff --git a/apps/app_speech_utils.c b/apps/app_speech_utils.c index f9c6e14d1c..3785119f54 100644 --- a/apps/app_speech_utils.c +++ b/apps/app_speech_utils.c @@ -284,7 +284,11 @@ static struct ast_speech *find_speech(struct ast_channel *chan) { struct ast_speech *speech = NULL; struct ast_datastore *datastore = NULL; - + + if (!chan) { + return NULL; + } + datastore = ast_channel_datastore_find(chan, &speech_datastore, NULL); if (datastore == NULL) { return NULL; diff --git a/apps/app_stack.c b/apps/app_stack.c index 3118dfd7ba..4c8553c145 100644 --- a/apps/app_stack.c +++ b/apps/app_stack.c @@ -569,6 +569,11 @@ static int local_read(struct ast_channel *chan, const char *cmd, char *data, cha struct gosub_stack_frame *frame; struct ast_var_t *variables; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(stack_store = ast_channel_datastore_find(chan, &stack_info, NULL))) { ast_channel_unlock(chan); @@ -603,6 +608,11 @@ static int local_write(struct ast_channel *chan, const char *cmd, char *var, con AST_LIST_HEAD(, gosub_stack_frame) *oldlist; struct gosub_stack_frame *frame; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(stack_store = ast_channel_datastore_find(chan, &stack_info, NULL))) { ast_log(LOG_ERROR, "Tried to set LOCAL(%s), but we aren't within a Gosub routine\n", var); diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index a442d2c2a3..02a5f8b1da 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -9936,10 +9936,17 @@ static int socket_process_meta(int packet_len, struct ast_iax2_meta_hdr *meta, s static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len) { - struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL); + struct ast_datastore *variablestore; AST_LIST_HEAD(, ast_var_t) *varlist; struct ast_var_t *var; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + + variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL); + if (!variablestore) { *buf = '\0'; return 0; @@ -9959,10 +9966,17 @@ static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data static int acf_iaxvar_write(struct ast_channel *chan, const char *cmd, char *data, const char *value) { - struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL); + struct ast_datastore *variablestore; AST_LIST_HEAD(, ast_var_t) *varlist; struct ast_var_t *var; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + + variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL); + if (!variablestore) { variablestore = ast_datastore_alloc(&iax2_variable_datastore_info, NULL); if (!variablestore) { @@ -14127,8 +14141,9 @@ static int function_iaxpeer(struct ast_channel *chan, const char *cmd, char *dat /* if our channel, return the IP address of the endpoint of current channel */ if (!strcmp(peername,"CURRENTCHANNEL")) { unsigned short callno; - if (chan->tech != &iax2_tech) + if (!chan || chan->tech != &iax2_tech) { return -1; + } callno = PTR_TO_CALLNO(chan->tech_pvt); ast_copy_string(buf, iaxs[callno]->addr.sin_addr.s_addr ? ast_inet_ntoa(iaxs[callno]->addr.sin_addr) : "", len); return 0; diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 8f01e9a407..af6982490b 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -20120,7 +20120,12 @@ static int func_header_read(struct ast_channel *chan, const char *function, char ); int i, number, start = 0; - if (ast_strlen_zero(data)) { + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function); + return -1; + } + + if (ast_strlen_zero(data)) { ast_log(LOG_WARNING, "This function requires a header name.\n"); return -1; } @@ -20293,8 +20298,13 @@ static int function_sipchaninfo_read(struct ast_channel *chan, const char *cmd, static int deprecated = 0; *buf = 0; - - if (!data) { + + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + + if (!data) { ast_log(LOG_WARNING, "This function requires a parameter name.\n"); return -1; } diff --git a/funcs/func_blacklist.c b/funcs/func_blacklist.c index be3bbc5fbd..4348b019b7 100644 --- a/funcs/func_blacklist.c +++ b/funcs/func_blacklist.c @@ -61,6 +61,11 @@ static int blacklist_read(struct ast_channel *chan, const char *cmd, char *data, char blacklist[1]; int bl = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (chan->caller.id.number.valid && chan->caller.id.number.str) { if (!ast_db_get("blacklist", chan->caller.id.number.str, blacklist, sizeof (blacklist))) bl = 1; diff --git a/funcs/func_callcompletion.c b/funcs/func_callcompletion.c index cee06faa47..cb1cd59b3f 100644 --- a/funcs/func_callcompletion.c +++ b/funcs/func_callcompletion.c @@ -74,6 +74,11 @@ static int acf_cc_read(struct ast_channel *chan, const char *name, char *data, struct ast_cc_config_params *cc_params; int res; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", name); + return -1; + } + ast_channel_lock(chan); if (!(cc_params = ast_channel_get_cc_config_params(chan))) { ast_channel_unlock(chan); @@ -91,6 +96,11 @@ static int acf_cc_write(struct ast_channel *chan, const char *cmd, char *data, struct ast_cc_config_params *cc_params; int res; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(cc_params = ast_channel_get_cc_config_params(chan))) { ast_channel_unlock(chan); diff --git a/funcs/func_callerid.c b/funcs/func_callerid.c index 1a3fc6f196..1b14f1718a 100644 --- a/funcs/func_callerid.c +++ b/funcs/func_callerid.c @@ -812,6 +812,11 @@ static int callerpres_deprecate_notify; */ static int callerpres_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len) { + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (!callerpres_deprecate_notify) { callerpres_deprecate_notify = 1; ast_log(LOG_WARNING, "CALLERPRES is deprecated." @@ -838,6 +843,11 @@ static int callerpres_write(struct ast_channel *chan, const char *cmd, char *dat { int pres; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (!callerpres_deprecate_notify) { callerpres_deprecate_notify = 1; ast_log(LOG_WARNING, "CALLERPRES is deprecated." diff --git a/funcs/func_channel.c b/funcs/func_channel.c index 7bca6bf7f9..34d681bcbe 100644 --- a/funcs/func_channel.c +++ b/funcs/func_channel.c @@ -338,6 +338,11 @@ static int func_channel_read(struct ast_channel *chan, const char *function, { int ret = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function); + return -1; + } + if (!strcasecmp(data, "audionativeformat")) /* use the _multiple version when chan->nativeformats holds multiple formats */ /* ast_getformatname_multiple(buf, len, chan->nativeformats & AST_FORMAT_AUDIO_MASK); */ @@ -580,6 +585,11 @@ static int func_channel_write(struct ast_channel *chan, const char *function, ch .value = value, }; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function); + return -1; + } + res = func_channel_write_real(chan, function, data, value); ast_channel_setoption(chan, AST_OPTION_CHANNEL_WRITE, &write_info, sizeof(write_info), 0); @@ -653,8 +663,15 @@ static struct ast_custom_function channels_function = { static int func_mchan_read(struct ast_channel *chan, const char *function, char *data, struct ast_str **buf, ssize_t len) { - struct ast_channel *mchan = ast_channel_get_by_name(chan->linkedid); + struct ast_channel *mchan; char *template = ast_alloca(4 + strlen(data)); + + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function); + return -1; + } + + mchan = ast_channel_get_by_name(chan->linkedid); sprintf(template, "${%s}", data); /* SAFE */ ast_str_substitute_variables(buf, len, mchan ? mchan : chan, template); if (mchan) { @@ -666,7 +683,14 @@ static int func_mchan_read(struct ast_channel *chan, const char *function, static int func_mchan_write(struct ast_channel *chan, const char *function, char *data, const char *value) { - struct ast_channel *mchan = ast_channel_get_by_name(chan->linkedid); + struct ast_channel *mchan; + + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function); + return -1; + } + + mchan = ast_channel_get_by_name(chan->linkedid); pbx_builtin_setvar_helper(mchan ? mchan : chan, data, value); if (mchan) { ast_channel_unref(mchan); diff --git a/funcs/func_dialplan.c b/funcs/func_dialplan.c index 372ee613fb..6e87628f74 100644 --- a/funcs/func_dialplan.c +++ b/funcs/func_dialplan.c @@ -78,20 +78,23 @@ static int isexten_function_read(struct ast_channel *chan, const char *cmd, char int priority_num; if (sscanf(args.priority, "%30d", &priority_num) == 1 && priority_num > 0) { int res; - res = ast_exists_extension(chan, args.context, args.exten, priority_num, + res = ast_exists_extension(chan, args.context, args.exten, priority_num, + !chan ? NULL : S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL)); if (res) strcpy(buf, "1"); } else { int res; res = ast_findlabel_extension(chan, args.context, args.exten, args.priority, + !chan ? NULL : S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL)); if (res > 0) strcpy(buf, "1"); } } else if (!ast_strlen_zero(args.exten)) { int res; - res = ast_exists_extension(chan, args.context, args.exten, 1, + res = ast_exists_extension(chan, args.context, args.exten, 1, + !chan ? NULL : S_COR(chan->caller.id.number.valid, chan->caller.id.number.str, NULL)); if (res) strcpy(buf, "1"); diff --git a/funcs/func_frame_trace.c b/funcs/func_frame_trace.c index 0c1bc81cf6..9b2785e322 100644 --- a/funcs/func_frame_trace.c +++ b/funcs/func_frame_trace.c @@ -157,6 +157,11 @@ static int frame_trace_helper(struct ast_channel *chan, const char *cmd, char *d }; int i = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (!(framedata = ast_calloc(1, sizeof(*framedata)))) { return 0; } diff --git a/funcs/func_global.c b/funcs/func_global.c index 66b04a97bc..c84374fdc8 100644 --- a/funcs/func_global.c +++ b/funcs/func_global.c @@ -155,6 +155,9 @@ static int shared_read(struct ast_channel *chan, const char *cmd, char *data, ch return -1; } chan = c_ref; + } else if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; } ast_channel_lock(chan); @@ -213,6 +216,9 @@ static int shared_write(struct ast_channel *chan, const char *cmd, char *data, c return -1; } chan = c_ref; + } else if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; } ast_channel_lock(chan); diff --git a/funcs/func_groupcount.c b/funcs/func_groupcount.c index 609d01fefa..5ebd723def 100644 --- a/funcs/func_groupcount.c +++ b/funcs/func_groupcount.c @@ -104,6 +104,11 @@ static int group_count_function_read(struct ast_channel *chan, const char *cmd, int count = -1; char group[80] = "", category[80] = ""; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_app_group_split_group(data, group, sizeof(group), category, sizeof(category)); @@ -174,9 +179,14 @@ static int group_function_read(struct ast_channel *chan, const char *cmd, { int ret = -1; struct ast_group_info *gi = NULL; - + + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_app_group_list_rdlock(); - + for (gi = ast_app_group_list_head(); gi; gi = AST_LIST_NEXT(gi, group_list)) { if (gi->chan != chan) continue; @@ -201,6 +211,11 @@ static int group_function_write(struct ast_channel *chan, const char *cmd, { char grpcat[256]; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (!value) { return -1; } diff --git a/funcs/func_math.c b/funcs/func_math.c index 36f3fc48a6..2bc68c579a 100644 --- a/funcs/func_math.c +++ b/funcs/func_math.c @@ -392,6 +392,11 @@ static int crement_function_read(struct ast_channel *chan, const char *cmd, return -1; } + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(var = pbx_builtin_getvar_helper(chan, data))) { diff --git a/funcs/func_odbc.c b/funcs/func_odbc.c index b8e60b495b..ee6384c7cd 100644 --- a/funcs/func_odbc.c +++ b/funcs/func_odbc.c @@ -801,6 +801,11 @@ static int acf_fetch(struct ast_channel *chan, const char *cmd, char *data, char struct odbc_datastore *resultset; struct odbc_datastore_row *row; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); store = ast_channel_datastore_find(chan, &odbc_info, data); if (!store) { diff --git a/funcs/func_pitchshift.c b/funcs/func_pitchshift.c index 1b4e7fb1b6..82410674c7 100644 --- a/funcs/func_pitchshift.c +++ b/funcs/func_pitchshift.c @@ -201,6 +201,11 @@ static int pitchshift_helper(struct ast_channel *chan, const char *cmd, char *da int new = 0; float amount = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(datastore = ast_channel_datastore_find(chan, &pitchshift_datastore, NULL))) { ast_channel_unlock(chan); diff --git a/funcs/func_speex.c b/funcs/func_speex.c index 86ea82b092..0a716d7bfd 100644 --- a/funcs/func_speex.c +++ b/funcs/func_speex.c @@ -200,6 +200,11 @@ static int speex_write(struct ast_channel *chan, const char *cmd, char *data, co struct speex_direction_info **sdi = NULL; int is_new = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (strcasecmp(data, "rx") && strcasecmp(data, "tx")) { ast_log(LOG_ERROR, "Invalid argument provided to the %s function\n", cmd); return -1; diff --git a/funcs/func_strings.c b/funcs/func_strings.c index 5ac19305eb..767ea225b8 100644 --- a/funcs/func_strings.c +++ b/funcs/func_strings.c @@ -990,6 +990,11 @@ static int hashkeys_read(struct ast_channel *chan, const char *cmd, char *data, struct ast_var_t *newvar; struct ast_str *prefix = ast_str_alloca(80); + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_str_set(&prefix, -1, HASH_PREFIX, data); memset(buf, 0, len); @@ -1012,6 +1017,11 @@ static int hashkeys_read2(struct ast_channel *chan, const char *cmd, char *data, struct ast_str *prefix = ast_str_alloca(80); char *tmp; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_str_set(&prefix, -1, HASH_PREFIX, data); AST_LIST_TRAVERSE(&chan->varshead, newvar, entries) { @@ -1081,6 +1091,11 @@ static int hash_read(struct ast_channel *chan, const char *cmd, char *data, char AST_APP_ARG(col)[100]; ); + if (!chan) { + ast_log(LOG_WARNING, "No channel and only 1 parameter was provided to %s function.\n", cmd); + return -1; + } + /* Get column names, in no particular order */ hashkeys_read(chan, "HASHKEYS", arg.hashname, colnames, sizeof(colnames)); pbx_builtin_setvar_helper(chan, "~ODBCFIELDS~", colnames); diff --git a/funcs/func_volume.c b/funcs/func_volume.c index 6080bc442b..bf169fecc6 100644 --- a/funcs/func_volume.c +++ b/funcs/func_volume.c @@ -156,12 +156,17 @@ static int volume_write(struct ast_channel *chan, const char *cmd, char *data, c int is_new = 0; /* Separate options from argument */ - + AST_DECLARE_APP_ARGS(args, AST_APP_ARG(direction); AST_APP_ARG(options); ); - + + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + AST_STANDARD_APP_ARGS(args, data); ast_channel_lock(chan); diff --git a/res/res_calendar.c b/res/res_calendar.c index 6e509d7347..a28700b5c2 100644 --- a/res/res_calendar.c +++ b/res/res_calendar.c @@ -1585,6 +1585,11 @@ static int calendar_event_read(struct ast_channel *chan, const char *cmd, char * struct ast_datastore *datastore; struct ast_calendar_event *event; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + if (ast_strlen_zero(data)) { ast_log(LOG_WARNING, "%s requires an argument\n", cmd); return -1; diff --git a/res/res_jabber.c b/res/res_jabber.c index 1dc3bf73c4..bd3763ba59 100644 --- a/res/res_jabber.c +++ b/res/res_jabber.c @@ -827,7 +827,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch start = ast_tvnow(); - if (ast_autoservice_start(chan) < 0) { + if (chan && ast_autoservice_start(chan) < 0) { ast_log(LOG_WARNING, "Cannot start autoservice for channel %s\n", chan->name); ASTOBJ_UNREF(client, ast_aji_client_destroy); return -1; @@ -899,7 +899,7 @@ static int acf_jabberreceive_read(struct ast_channel *chan, const char *name, ch } ASTOBJ_UNREF(client, ast_aji_client_destroy); - if (ast_autoservice_stop(chan) < 0) { + if (chan && ast_autoservice_stop(chan) < 0) { ast_log(LOG_WARNING, "Cannot stop autoservice for channel %s\n", chan->name); } diff --git a/res/res_mutestream.c b/res/res_mutestream.c index 000a7fb3da..bdc872671a 100644 --- a/res/res_mutestream.c +++ b/res/res_mutestream.c @@ -206,6 +206,11 @@ static int func_mute_write(struct ast_channel *chan, const char *cmd, char *data struct mute_information *mute = NULL; int is_new = 0; + if (!chan) { + ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd); + return -1; + } + ast_channel_lock(chan); if (!(datastore = ast_channel_datastore_find(chan, &mute_datastore, NULL))) { if (!(datastore = initialize_mutehook(chan))) {