<p>Joshua Colp <strong>merged</strong> this change.</p><p><a href="https://gerrit.asterisk.org/8312">View Change</a></p><div style="white-space:pre-wrap">Approvals:
  Jenkins2: Verified
  Joshua Colp: Looks good to me, approved; Approved for Submit

</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">AST-2018-001: rtp / channel: Don't allow an unnegotiated format to be passed up.<br><br>When an RTP packet is received by an RTP engine it has to map the<br>payload into the Asterisk format. The code was incorrectly checking<br>our own static list for ALL payloads if it couldn't find a negotiated one.<br>This included dynamic payloads. If the payload mapped to a format<br>of a different type (for example receiving a video packet on an audio<br>RTP instance) then the core stream code could cause a crash if a legacy<br>channel driver was in use as no stream would be present.<br><br>To provide further protection the core stream code will no longer assume<br>that a video or audio frame will always have a stream for legacy channel<br>drivers. If no stream is present the frame is dropped.<br><br>ASTERISK-27488<br><br>Change-Id: I022556f524ad8379ee73f14037040af17ea3316a<br>---<br>M main/channel.c<br>M main/rtp_engine.c<br>2 files changed, 18 insertions(+), 3 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">diff --git a/main/channel.c b/main/channel.c<br>index fc89d67..c71d19b 100644<br>--- a/main/channel.c<br>+++ b/main/channel.c<br>@@ -3667,7 +3667,17 @@<br>                              * originated from and update the frame to include it.<br>                                 */<br>                           stream = default_stream = ast_channel_get_default_stream(chan, ast_format_get_type(f->subclass.format));<br>-                          f->stream_num = ast_stream_get_position(stream);<br>+                          /* In order to allow media to be passed up the underlying media type has to have a format negotiated on<br>+                               * the channel itself. In cases where this hasn't happened the channel driver is incorrectly passing up<br>+                           * a frame for a format that has not been negotiated. If this occurs just drop the frame as we have no<br>+                                * stream that it came from.<br>+                          */<br>+                          if (!stream) {<br>+                                       ast_frfree(f);<br>+                                       f = &ast_null_frame;<br>+                             } else {<br>+                                     f->stream_num = ast_stream_get_position(stream);<br>+                          }<br>                     }<br>             }<br>     } else {<br>@@ -3700,7 +3710,12 @@<br>                       */<br>                   if (f && (f->frametype == AST_FRAME_VOICE || f->frametype == AST_FRAME_VIDEO)) {<br>                                stream = default_stream = ast_channel_get_default_stream(chan, ast_format_get_type(f->subclass.format));<br>-                          f->stream_num = ast_stream_get_position(stream);<br>+                          if (!stream) {<br>+                                       ast_frfree(f);<br>+                                       f = &ast_null_frame;<br>+                             } else {<br>+                                     f->stream_num = ast_stream_get_position(stream);<br>+                          }<br>                     }<br>             }<br>             else<br>diff --git a/main/rtp_engine.c b/main/rtp_engine.c<br>index cb60464..5242e81 100644<br>--- a/main/rtp_engine.c<br>+++ b/main/rtp_engine.c<br>@@ -1210,7 +1210,7 @@<br>      }<br>     ast_rwlock_unlock(&codecs->codecs_lock);<br> <br>-   if (!type) {<br>+ if (!type && payload <= AST_RTP_PT_LAST_STATIC) {<br>          ast_rwlock_rdlock(&static_RTP_PT_lock);<br>           type = ao2_bump(static_RTP_PT[payload]);<br>              ast_rwlock_unlock(&static_RTP_PT_lock);<br></pre><p>To view, visit <a href="https://gerrit.asterisk.org/8312">change 8312</a>. To unsubscribe, visit <a href="https://gerrit.asterisk.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.asterisk.org/8312"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: asterisk </div>
<div style="display:none"> Gerrit-Branch: 15 </div>
<div style="display:none"> Gerrit-MessageType: merged </div>
<div style="display:none"> Gerrit-Change-Id: I022556f524ad8379ee73f14037040af17ea3316a </div>
<div style="display:none"> Gerrit-Change-Number: 8312 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Joshua Colp <jcolp@digium.com> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins2 </div>
<div style="display:none"> Gerrit-Reviewer: Joshua Colp <jcolp@digium.com> </div>