[asterisk-bugs] [Asterisk 0019229]: Coding error in find_subchannel_and_lock()

[Asterisk Bug Tracker]

The following issue has been SUBMITTED. 
====================================================================== 
https://issues.asterisk.org/view.php?id=19229 
====================================================================== 
Reported By:                JeffW
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   19229
Category:                   Channels/chan_mgcp
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     new
Asterisk Version:           1.8.3.2 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2011-05-04 12:39 CDT
Last Modified:              2011-05-04 12:39 CDT
====================================================================== 
Summary:                    Coding error in find_subchannel_and_lock()
Description: 
The function find_subchannel_and_lock()in mgcp_chan.c has a coding error in
two locations that prevent the subchannel from being found on non-dynamic
gateways. This results in responses from half the gateways to be ignored. 
I built Asterisk from source on a Fedora 14 system.  Here is the C code in
question from Asterisk version 1.8.3.2:


	for (g = gateways ? gateways : find_realtime_gw(name, at, sin);
                g; g = g->next ? g->next : find_realtime_gw(name, at,
sin)) {

        [lines omitted]

                        /* not dynamic, check if the name matches */
                        } else if (name) {
                             if (strcasecmp(g->name, at)) {
>>>> error >>>>                 g = g->next;
                                continue;
                             }
                        /* not dynamic, no name, check if the addr matches
*/
                        } else if (!name && sin) {
                             if ((g->addr.sin_addr.s_addr != 
                                  sin->sin_addr.s_addr) ||
                                 (g->addr.sin_port != sin->sin_port)) {
>>>> error >>>>                  if(!g->next)
>>>> error >>>>                        g = find_realtime_gw(name, at,
sin);
>>>> error >>>>                   else
>>>> error >>>>                        g = g->next;
                                  continue;
                            }
                        } else {
                            continue;
                        }

Since the "for" statement includes updating "g" from "g->next", the extra
updates to "g" in the code above cause gateway entries to be skipped and
responses from those gateways to continually exceed the maximum retry
count.

I hope this helps!

Jeff Waltz
====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-05-04 12:39 JeffW          New Issue                                    
2011-05-04 12:39 JeffW          Asterisk Version          => 1.8.3.2         
2011-05-04 12:39 JeffW          Regression                => No              
2011-05-04 12:39 JeffW          SVN Branch (only for SVN checkouts, not tarball
releases) => N/A             
======================================================================