[svn-commits] rmudgett: branch 1.4 r790 - /branches/1.4/q931.c

[SVN commits to the Digium repositories]

Author: rmudgett
Date: Thu May  7 11:06:19 2009
New Revision: 790

URL: http://svn.asterisk.org/svn-view/libpri?view=rev&rev=790
Log:
Avoid a stale pointer crash if the TE BRI TEI is removed when active calls exist.

Made the q931_call record point to the master D channel control structure
instead of the BRI TEI subchannel control structure.  When a layer 3 message
is sent, the current TEI subchannel control structure is used.

Modified:
    branches/1.4/q931.c

Modified: branches/1.4/q931.c
URL: http://svn.asterisk.org/svn-view/libpri/branches/1.4/q931.c?view=diff&rev=790&r1=789&r2=790
==============================================================================
--- branches/1.4/q931.c (original)
+++ branches/1.4/q931.c Thu May  7 11:06:19 2009
@@ -2382,10 +2382,15 @@
 	/* Call reference */
 	cur->cr = cr;
 	/* PRI is set to whoever called us */
-	if (pri->bri && (pri->localtype == PRI_CPE) && pri->subchannel && outboundnew)
-		cur->pri = pri->subchannel;
-	else
+	if (pri->bri && (pri->localtype == PRI_CPE)) {
+		/*
+		 * Point to the master to avoid stale pointer problems if
+		 * the TEI is removed later.
+		 */
+		cur->pri = master;
+	} else {
 		cur->pri = pri;
+	}
 
 	/* Append to end of list */
 	if (prev)
@@ -2680,7 +2685,19 @@
 	}
 	/* Invert the logic */
 	len = sizeof(buf) - len;
-	q931_xmit(c->pri, h, len, 1);
+
+	pri = c->pri;
+	if (pri->bri && (pri->localtype == PRI_CPE)) {
+		/*
+		 * Must use the BRI subchannel structure to send with the correct TEI.
+		 * Note: If the subchannel is NULL then there is no TEI assigned and
+		 * we should not be sending anything out at this time.
+		 */
+		pri = pri->subchannel;
+	}
+	if (pri) {
+		q931_xmit(pri, h, len, 1);
+	}
 	c->acked = 1;
 	return 0;
 }