Prevent crash during synchronous AMI origination by ref bumping returned channel

The originate APIs allow callers to provide a pointer to a channel that will
point to the originated channel if the function call succeeds. This is used by AMI
to provide channel information when the originate is performed synchronously.
Unfortunately, if the originate fails in certain ways, the outbound channel is
already disposed of during the dialing itself. This results in the channel being
improperly dereferenced by the internal originate function in pbx.c.

This patch ref bumps the channel to prevent this from occurring. Callers must now
unlock and unref the channel (which is more in line with general channel management
guidelines anyway).

This only affects manager, as it is the only consumer of this API function that
actually passes in a channel pointer.

Review: https://reviewboard.asterisk.org/r/2617/

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@393361 65c4cc65-6c06-0410-ace0-fbb531ad65f3

3 files changed, 57 insertions, 8 deletions

diff --git a/include/asterisk/pbx.h b/include/asterisk/pbx.h
index 825dae7bd..54e116ae0 100644
--- a/include/asterisk/pbx.h
+++ b/include/asterisk/pbx.h
@@ -1083,13 +1083,59 @@ int ast_async_goto(struct ast_channel *chan, const char *context, const char *ex
  */
 int ast_async_goto_by_name(const char *chan, const char *context, const char *exten, int priority);
 
-/*! Synchronously or asynchronously make an outbound call and send it to a
-   particular extension */
-int ast_pbx_outgoing_exten(const char *type, struct ast_format_cap *cap, const char *addr, int timeout, const char *context, const char *exten, int priority, int *reason, int sync, const char *cid_num, const char *cid_name, struct ast_variable *vars, const char *account, struct ast_channel **locked_channel, int early_media);
-
-/*! Synchronously or asynchronously make an outbound call and send it to a
-   particular application with given extension */
-int ast_pbx_outgoing_app(const char *type, struct ast_format_cap *cap, const char *addr, int timeout, const char *app, const char *appdata, int *reason, int sync, const char *cid_num, const char *cid_name, struct ast_variable *vars, const char *account, struct ast_channel **locked_channel);
+/*! \brief Synchronously or asynchronously make an outbound call and send it to a
+ * particular extension
+ *
+ * \param type The channel technology to create
+ * \param cap The format capabilities for the channel
+ * \param addr Address data to pass to the channel technology driver
+ * \param timeout How long we should attempt to dial the outbound channel
+ * \param context The destination context for the outbound channel
+ * \param exten The destination extension for the outbound channel
+ * \param priority The destination priority for the outbound channel
+ * \param reason Optional. If provided, the hangup cause code of the outbound channel if
+ *  it failed
+ * \param sync If non-zero, block until the outbound channel answers
+ * \param cid_num The caller ID number to set on the outbound channel
+ * \param cid_name The caller ID name to set on the outbound channel
+ * \param vars Variables to set on the outbound channel
+ * \param account The accountcode for the outbound channel
+ * \param locked_channel Optional. The outbound channel that was created. This is returned
+ *  both locked and reference bumped. If a caller provides a channel parameter, it must
+ *  unlock the channel and decrement the reference count.
+ * \param early_media If non-zero, allow early-media on the originated channel
+ */
+int ast_pbx_outgoing_exten(const char *type, struct ast_format_cap *cap, const char *addr,
+    int timeout, const char *context, const char *exten, int priority, int *reason,
+    int sync, const char *cid_num, const char *cid_name, struct ast_variable *vars,
+    const char *account, struct ast_channel **locked_channel, int early_media);
+
+/*! \brief Synchronously or asynchronously make an outbound call and execute an
+ *  application on the channel.
+ *
+ * Note that when the application stops executing, the channel is hungup.
+ *
+ * \param type The channel technology to create
+ * \param cap The format capabilities for the channel
+ * \param addr Address data to pass to the channel technology driver
+ * \param timeout How long we should attempt to dial the outbound channel
+ * \param app The name of the application to execute
+ * \param appdata Data to pass to the application
+ * \param reason Optional. If provided, the hangup cause code of the outbound channel if
+ *  it failed
+ * \param sync If non-zero, block until the outbound channel answers
+ * \param cid_num The caller ID number to set on the outbound channel
+ * \param cid_name The caller ID name to set on the outbound channel
+ * \param vars Variables to set on the outbound channel
+ * \param account The accountcode for the outbound channel
+ * \param locked_channel Optional. The outbound channel that was created. This is returned
+ *  both locked and reference bumped. If a caller provides a channel parameter, it must
+ *  unlock the channel and decrement the reference count.
+ */
+int ast_pbx_outgoing_app(const char *type, struct ast_format_cap *cap, const char *addr,
+    int timeout, const char *app, const char *appdata, int *reason, int sync,
+    const char *cid_num, const char *cid_name, struct ast_variable *vars,
+    const char *account, struct ast_channel **locked_channel);
 
 /*!
  * \brief Evaluate a condition
diff --git a/main/manager.c b/main/manager.c
index 7e5b1080c..ec031303b 100644
--- a/main/manager.c
+++ b/main/manager.c
@@ -4329,9 +4329,10 @@ static void *fast_originate(void *data)
 		S_OR(in->cid_name, "<unknown>")
 		);
 
-	/* Locked by ast_pbx_outgoing_exten or ast_pbx_outgoing_app */
+	/* Locked and ref'd by ast_pbx_outgoing_exten or ast_pbx_outgoing_app */
 	if (chan) {
 		ast_channel_unlock(chan);
+		ast_channel_unref(chan);
 	}
 	destroy_fast_originate_helper(in);
 	return NULL;
diff --git a/main/pbx.c b/main/pbx.c
index db737327f..8079edc62 100644
--- a/main/pbx.c
+++ b/main/pbx.c
@@ -9967,6 +9967,7 @@ static int pbx_outgoing_attempt(const char *type, struct ast_format_cap *cap, co
 
 	if (channel) {
 		*channel = dialed;
+		ast_channel_ref(*channel);
 		ast_channel_lock(*channel);
 	}
 
@@ -9981,6 +9982,7 @@ static int pbx_outgoing_attempt(const char *type, struct ast_format_cap *cap, co
 		ast_log(LOG_WARNING, "Unable to spawn dialing thread for '%s/%s'\n", type, addr);
 		if (channel) {
 			ast_channel_unlock(*channel);
+			ast_channel_unref(*channel);
 		}
 		ao2_ref(outgoing, -1);
 		return -1;