[asterisk-bugs] [JIRA] (ASTERISK-23739) Asterisk crashes on voicemail option 8 (message forward) when ODBC storage and voicmail_data realtime enabled

[Stas Kobzar (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-23739?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Stas Kobzar updated ASTERISK-23739:
-----------------------------------

    Description: 
Hello,

Asterisk is crashing with with segfaul on VoiceMail application when using option 8 (forward message to another voicemail box). This happens when Asterisk is compiled with voicemail ODBC storage and voicemail_data realtime is enabled in extconfig.conf.

To reproduce:
- Asterisk configured with voicemail storage ODBC
- realtime voicemail_data family enabled
- Call to Voicemail and use option 8 to forward new voicemail. When prompted forward options press "2". Asterisk will crash with segfault. 

This is happens because in function _copy_plain_file_ Asterisk is trying to load a voicemail message from realtime voicemail_data family:
{code}
if (ast_check_realtime("voicemail_data")) {
  var = ast_load_realtime("voicemail_data", "filename", frompath, SENTINEL);
  for (tmp = var; tmp; tmp = tmp->next) {
    if (!strcasecmp(tmp->name, "origmailbox")) {
      origmailbox = tmp->value;
  ...
{/code}

If the record does not exists, following assignment will crash Asterisk:
{code}
origmailbox = tmp->value;
{/code}





  was:
Hello,

Asterisk is crashing with with segfaul on VoiceMail application when using option 8 (forward message to another voicemail box). This happens when Asterisk is compiled with voicemail ODBC storage and voicemail_data realtime is enabled in extconfig.conf.

To reproduce:
- Asterisk configured with voicemail storage ODBC
- realtime voicemail_data family enabled
- Call to Voicemail and use option 8 to forward new voicemail. When prompted forward options press "2". Asterisk will crash with segfault. 

This is happens because in function _copy_plain_file_ Asterisk is trying to load a voicemail message from realtime voicemail_data family:
{code}
if (ast_check_realtime("voicemail_data")) {
  var = ast_load_realtime("voicemail_data", "filename", frompath, SENTINEL);
  for (tmp = var; tmp; tmp = tmp->next) {
    if (!strcasecmp(tmp->name, "origmailbox")) {
      origmailbox = tmp->value;
  ...
{/code}

If the record does not exists, following assignment will crash Asterisk:
{code}origmailbox = tmp->value;{/code}






> Asterisk crashes on voicemail option 8 (message forward) when ODBC storage and voicmail_data realtime enabled
> -------------------------------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-23739
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23739
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Applications/app_voicemail, Applications/app_voicemail/ODBC
>    Affects Versions: 11.9.0
>            Reporter: Stas Kobzar
>            Severity: Minor
>
> Hello,
> Asterisk is crashing with with segfaul on VoiceMail application when using option 8 (forward message to another voicemail box). This happens when Asterisk is compiled with voicemail ODBC storage and voicemail_data realtime is enabled in extconfig.conf.
> To reproduce:
> - Asterisk configured with voicemail storage ODBC
> - realtime voicemail_data family enabled
> - Call to Voicemail and use option 8 to forward new voicemail. When prompted forward options press "2". Asterisk will crash with segfault. 
> This is happens because in function _copy_plain_file_ Asterisk is trying to load a voicemail message from realtime voicemail_data family:
> {code}
> if (ast_check_realtime("voicemail_data")) {
>   var = ast_load_realtime("voicemail_data", "filename", frompath, SENTINEL);
>   for (tmp = var; tmp; tmp = tmp->next) {
>     if (!strcasecmp(tmp->name, "origmailbox")) {
>       origmailbox = tmp->value;
>   ...
> {/code}
> If the record does not exists, following assignment will crash Asterisk:
> {code}
> origmailbox = tmp->value;
> {/code}



--
This message was sent by Atlassian JIRA
(v6.2#6252)