[svn-commits] dvossel: branch 1.6.2 r324634 - in /branches/1.6.2: ./ channels/ main/

[SVN commits to the Digium repositories]

Author: dvossel
Date: Thu Jun 23 13:18:46 2011
New Revision: 324634

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=324634
Log:
Merged revisions 324627 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r324627 | dvossel | 2011-06-23 13:16:52 -0500 (Thu, 23 Jun 2011) | 7 lines
  
  Addresses AST-2011-010, remote crash in IAX2 driver
  
  Thanks to twilson for identifying the issue and providing the patches.
  
  AST-2011-010
........

Modified:
    branches/1.6.2/   (props changed)
    branches/1.6.2/channels/chan_iax2.c
    branches/1.6.2/main/features.c

Propchange: branches/1.6.2/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: branches/1.6.2/channels/chan_iax2.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.2/channels/chan_iax2.c?view=diff&rev=324634&r1=324633&r2=324634
==============================================================================
--- branches/1.6.2/channels/chan_iax2.c (original)
+++ branches/1.6.2/channels/chan_iax2.c Thu Jun 23 13:18:46 2011
@@ -5081,7 +5081,14 @@
 	case AST_OPTION_OPRMODE:
 		errno = EINVAL;
 		return -1;
-	default:
+ 	/* These options are sent to the other side across the network where
+ 	 * they will be passed to whatever channel is bridged there. Don't
+ 	 * do anything silly like pass an option that transmits pointers to
+ 	 * memory on this machine to a remote machine to use */
+ 	case AST_OPTION_TONE_VERIFY:
+ 	case AST_OPTION_TDD:
+ 	case AST_OPTION_RELAXDTMF:
+ 	case AST_OPTION_AUDIO_MODE:
 	{
 		unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
 		struct chan_iax2_pvt *pvt;
@@ -5109,7 +5116,12 @@
 		ast_free(h);
 		return res;
 	}
-	}
+	default:
+		return -1;
+	}
+
+	/* Just in case someone does a break instead of a return */
+	return -1;
 }
 
 static struct ast_frame *iax2_read(struct ast_channel *c) 

Modified: branches/1.6.2/main/features.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.2/main/features.c?view=diff&rev=324634&r1=324633&r2=324634
==============================================================================
--- branches/1.6.2/main/features.c (original)
+++ branches/1.6.2/main/features.c Thu Jun 23 13:18:46 2011
@@ -3132,10 +3132,19 @@
 				break;
 			case AST_CONTROL_OPTION:
 				aoh = f->data.ptr;
-				/* Forward option Requests */
+				/* Forward option Requests, but only ones we know are safe
+				 * These are ONLY sent by chan_iax2 and I'm not convinced that
+				 * they are useful. I haven't deleted them entirely because I
+				 * just am not sure of the ramifications of removing them. */
 				if (aoh && aoh->flag == AST_OPTION_FLAG_REQUEST) {
-					ast_channel_setoption(other, ntohs(aoh->option), aoh->data, 
-						f->datalen - sizeof(struct ast_option_header), 0);
+				   	switch (ntohs(aoh->option)) {
+					case AST_OPTION_TONE_VERIFY:
+					case AST_OPTION_TDD:
+					case AST_OPTION_RELAXDTMF:
+					case AST_OPTION_AUDIO_MODE:
+						ast_channel_setoption(other, ntohs(aoh->option), aoh->data, 
+							f->datalen - sizeof(struct ast_option_header), 0);
+					}
 				}
 				break;
 			}