[Asterisk-code-review] main/format cap.c: Fix crash with video. (asterisk[15])

[Benjamin Keith Ford]

Benjamin Keith Ford has uploaded this change for review. ( https://gerrit.asterisk.org/6464


Change subject: main/format_cap.c: Fix crash with video.
......................................................................

main/format_cap.c: Fix crash with video.

When an endpoint without video capabilities is called by another
endpoint with video capabilities, or if both endpoints joined a
confbridge with video_mode=sfu, Asterisk will core dump. This is
due to a NULL value being passed into ast_format_cap_get_compatible
for the first argument, which is then referenced without a NULL
check. This change adds the NULL check, eliminating the crash.

Also removed a stray semicolon in the bridging code.

Change-Id: Ic86f8b65a4a26a60885b28b8b1a0b22e1b471d42
---
M main/bridge.c
M main/format_cap.c
2 files changed, 5 insertions(+), 1 deletion(-)



  git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/64/6464/1

diff --git a/main/bridge.c b/main/bridge.c
index ab12ecf..5d9c0c1 100644
--- a/main/bridge.c
+++ b/main/bridge.c
@@ -1741,7 +1741,7 @@
 
 	ao2_ref(bridge_channel, -1);
 
-join_exit:;
+join_exit:
 	ast_bridge_run_after_callback(chan);
 	bridge_channel_impart_signal(chan);
 	if (!(ast_channel_softhangup_internal_flag(chan) & AST_SOFTHANGUP_ASYNCGOTO)
diff --git a/main/format_cap.c b/main/format_cap.c
index b0897c0..12141ad 100644
--- a/main/format_cap.c
+++ b/main/format_cap.c
@@ -629,6 +629,10 @@
 {
 	int idx, res = 0;
 
+	if (!cap1) {
+		return -1;
+	}
+
 	for (idx = 0; idx < AST_VECTOR_SIZE(&cap1->preference_order); ++idx) {
 		struct format_cap_framed *framed = AST_VECTOR_GET(&cap1->preference_order, idx);
 		struct ast_format *format;

-- 
To view, visit https://gerrit.asterisk.org/6464
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 15
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ic86f8b65a4a26a60885b28b8b1a0b22e1b471d42
Gerrit-Change-Number: 6464
Gerrit-PatchSet: 1
Gerrit-Owner: Benjamin Keith Ford <bford at digium.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20170908/0fb7b73d/attachment.html>