[Asterisk-code-review] Change in asterisk[master]: bridge.c: NULL app causes crash during attended transfer

[Kevin Harwell (Code Review)]

Kevin Harwell has uploaded a new change for review.

  https://gerrit.asterisk.org/134

Change subject: bridge.c: NULL app causes crash during attended transfer
......................................................................

bridge.c: NULL app causes crash during attended transfer

Due to a race condition there was a chance that during an attended transfer the
channel's application would return NULL. This, of course, would cause a crash
when attempting to access the memory. This patch retrieves the channel's app
at an earlier time in processing in hopes that the app name is available.
However, if is not then "unknown" is used instead. Since some string value
should now always be present the crash can no longer occur.

ASTERISK-24869 #close
Reported by: viniciusfontes
Review: https://gerrit.asterisk.org/#/c/133/

Change-Id: I5134b84c4524906d8148817719d76ffb306488ac
---
M main/bridge.c
1 file changed, 4 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/34/134/1

diff --git a/main/bridge.c b/main/bridge.c
index b1c42ff..f9c837a 100644
--- a/main/bridge.c
+++ b/main/bridge.c
@@ -4473,6 +4473,10 @@
 	the_bridge = to_transferee_bridge ?: to_target_bridge;
 	chan_bridged = to_transferee_bridge ? to_transferee : to_transfer_target;
 	chan_unbridged = to_transferee_bridge ? to_transfer_target : to_transferee;
+	/* There is a race condition that makes it possible for the app to be NULL.
+	   Retrieve the app first thing in order to give the greatest chance of
+	   having a value */
+	app = ast_strdupa(ast_channel_appl(chan_unbridged) ?: "unknown");
 
 	{
 		int chan_count;
@@ -4515,7 +4519,6 @@
 		goto end;
 	}
 
-	app = ast_strdupa(ast_channel_appl(chan_unbridged));
 	if (bridge_channel_internal_queue_attended_transfer(transferee, chan_unbridged)) {
 		res = AST_BRIDGE_TRANSFER_FAIL;
 		goto end;

-- 
To view, visit https://gerrit.asterisk.org/134
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I5134b84c4524906d8148817719d76ffb306488ac
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Kevin Harwell <kharwell at digium.com>