[asterisk-commits] rmudgett: branch 10 r349559 - in /branches/10: ./ channels/chan_dahdi.c

[SVN commits to the Asterisk project]

Author: rmudgett
Date: Wed Jan  4 14:50:24 2012
New Revision: 349559

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=349559
Log:
Fix segfault in chan_dahdi for CHANNEL(dahdi_span) evaluation on hangup.

* Added NULL private pointer checks in the following chan_dahdi channel
callbacks: dahdi_func_read(), dahdi_func_write(), dahdi_setoption(), and
dahdi_queryoption().

(closes issue ASTERISK-19142)
Reported by: Diego Aguirre
Tested by: rmudgett
........

Merged revisions 349558 from http://svn.asterisk.org/svn/asterisk/branches/1.8

Modified:
    branches/10/   (props changed)
    branches/10/channels/chan_dahdi.c

Propchange: branches/10/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.

Modified: branches/10/channels/chan_dahdi.c
URL: http://svnview.digium.com/svn/asterisk/branches/10/channels/chan_dahdi.c?view=diff&rev=349559&r1=349558&r2=349559
==============================================================================
--- branches/10/channels/chan_dahdi.c (original)
+++ branches/10/channels/chan_dahdi.c Wed Jan  4 14:50:24 2012
@@ -6655,7 +6655,7 @@
 	struct dahdi_pvt *p = chan->tech_pvt;
 
 	/* all supported options require data */
-	if (!data || (*datalen < 1)) {
+	if (!p || !data || (*datalen < 1)) {
 		errno = EINVAL;
 		return -1;
 	}
@@ -6701,7 +6701,7 @@
 
 
 	/* all supported options require data */
-	if (!data || (datalen < 1)) {
+	if (!p || !data || (datalen < 1)) {
 		errno = EINVAL;
 		return -1;
 	}
@@ -6913,6 +6913,12 @@
 {
 	struct dahdi_pvt *p = chan->tech_pvt;
 	int res = 0;
+
+	if (!p) {
+		/* No private structure! */
+		*buf = '\0';
+		return -1;
+	}
 
 	if (!strcasecmp(data, "rxgain")) {
 		ast_mutex_lock(&p->lock);
@@ -7046,6 +7052,11 @@
 {
 	struct dahdi_pvt *p = chan->tech_pvt;
 	int res = 0;
+
+	if (!p) {
+		/* No private structure! */
+		return -1;
+	}
 
 	if (!strcasecmp(data, "buffers")) {
 		int num_bufs, policy;