[asterisk-commits] kmoore: trunk r408942 - in /trunk: ./ res/res_pjsip_refer.c

[SVN commits to the Asterisk project]

Author: kmoore
Date: Wed Feb 26 07:45:12 2014
New Revision: 408942

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=408942
Log:
PJSIP: Prevent crash if channel has gone away

It is currently possible for an ast_sip_session to exist without an
associated channel as is the case when a new invite is coming in or
just after a hangup is issued on a chan_pjsip channel. Part of the
attended transfer code assumed the channel would be non-NULL and used
it as such causing a crash. This bug was exposed thanks to the attended
transfer ARI test in the test suite.

(closes issue ASTERISK-23287)
Reported by: Matt Jordan
........

Merged revisions 408941 from http://svn.asterisk.org/svn/asterisk/branches/12

Modified:
    trunk/   (props changed)
    trunk/res/res_pjsip_refer.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-12-merged' - no diff available.

Modified: trunk/res/res_pjsip_refer.c
URL: http://svnview.digium.com/svn/asterisk/trunk/res/res_pjsip_refer.c?view=diff&rev=408942&r1=408941&r2=408942
==============================================================================
--- trunk/res/res_pjsip_refer.c (original)
+++ trunk/res/res_pjsip_refer.c Wed Feb 26 07:45:12 2014
@@ -421,6 +421,10 @@
 	RAII_VAR(struct refer_attended *, attended, data, ao2_cleanup);
 	int response = 0;
 
+	if (!attended->transferer_second->channel) {
+		return -1;
+	}
+
 	ast_debug(3, "Performing a REFER attended transfer - Transferer #1: %s Transferer #2: %s\n",
 		ast_channel_name(attended->transferer_chan), ast_channel_name(attended->transferer_second->channel));