[asterisk-commits] kharwell: branch 12 r402517 - /branches/12/apps/app_queue.c

[SVN commits to the Asterisk project]

Author: kharwell
Date: Wed Nov  6 15:57:04 2013
New Revision: 402517

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=402517
Log:
app_queue: crash if first agent is "busy"

If the first agent/member (via CLI "queue show") in a queue is "busy" (dnd,
circuit busy, etc...) and no agents answered then app_queue would crash.
This occurred because while the calling of agent(s) remained valid the channel
on "busy" agent would be set to NULL and then later dereferenced upon a second
"rna" function call.  The original intention of the code is to have only valid
"call attempt" objects (channels != NULL) checked while attempting to call
agent(s).  It does this by building a "call_next" list of valid "call attempt"
objects.  In the case of the "busy" agent subsequent builds of the valid "call
attempt" list would sometimes include (the case mentioned above) an invalid
"call attempt" object.

The fix was to make sure the "call attempt" list was appropriately built on
every iteration.  A NULL sanity check was also added at the original offending
spot of the crash just in case another one slipped by somehow.

(closes issue ASTERISK-22644)
Reported by: Marco Signorini
Review: https://reviewboard.asterisk.org/r/2983/

Modified:
    branches/12/apps/app_queue.c

Modified: branches/12/apps/app_queue.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/apps/app_queue.c?view=diff&rev=402517&r1=402516&r2=402517
==============================================================================
--- branches/12/apps/app_queue.c (original)
+++ branches/12/apps/app_queue.c Wed Nov  6 15:57:04 2013
@@ -4467,6 +4467,8 @@
 						}
 						prev = o;
 					}
+				} else if (prev) {
+					prev->call_next = NULL;
 				}
 				numlines++;
 			}
@@ -4927,7 +4929,9 @@
 
 	if (!*to) {
 		for (o = start; o; o = o->call_next) {
-			rna(orig, qe, o->chan, o->interface, o->member->membername, 1);
+			if (o->chan) {
+				rna(orig, qe, o->chan, o->interface, o->member->membername, 1);
+			}
 		}
 
 		publish_dial_end_event(qe->chan, outgoing, NULL, "NOANSWER");