diff options
| author | Matthew Jordan <mjordan@digium.com> | 2015-04-08 12:00:35 +0000 |
|---|---|---|
| committer | Matthew Jordan <mjordan@digium.com> | 2015-04-08 12:00:35 +0000 |
| commit | a9b6a624616fa7876b6232d2f7e7dd0438d630a9 (patch) | |
| tree | 556401f67124f8d931626e8f390f4e76a7bddbed /channels/chan_iax2.c | |
| parent | 477536ef25bf8a95ea4a43800ee14f15e0b67dcc (diff) | |
chan_iax2: Fix crash caused by unprotected access to iaxs[peer->callno]
This patch fixes an access to the peer callnumber that is unprotected by a
corresponding mutex. The peer->callno value can be changed by multiple threads,
and all data inside the iaxs array must be procted by a corresponding lock
of iaxsl.
The patch moves the unprotected access to a location where the mutex is
safely obtained.
Review: https://reviewboard.asterisk.org/r/4599/
ASTERISK-21211 #close
Reported by: Jaco Kroon
patches:
asterisk-11.2.1-iax2_poke-segfault.diff submitted by Jaco Kroon (License 5671)
........
Merged revisions 434291 from http://svn.asterisk.org/svn/asterisk/branches/11
........
Merged revisions 434292 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@434293 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels/chan_iax2.c')
| -rw-r--r-- | channels/chan_iax2.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index ff45b83fc..f56d84e3a 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -12325,15 +12325,11 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall) callno = peer->callno = find_callno(0, 0, &peer->addr, NEW_FORCE, peer->sockfd, 0); if (heldcall) ast_mutex_lock(&iaxsl[heldcall]); - if (peer->callno < 1) { + if (callno < 1) { ast_log(LOG_WARNING, "Unable to allocate call for poking peer '%s'\n", peer->name); return -1; } - /* Speed up retransmission times for this qualify call */ - iaxs[peer->callno]->pingtime = peer->maxms / 4 + 1; - iaxs[peer->callno]->peerpoke = peer; - if (peer->pokeexpire > -1) { if (!AST_SCHED_DEL(sched, peer->pokeexpire)) { peer->pokeexpire = -1; @@ -12354,6 +12350,10 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall) /* And send the poke */ ast_mutex_lock(&iaxsl[callno]); if (iaxs[callno]) { + /* Speed up retransmission times for this qualify call */ + iaxs[callno]->pingtime = peer->maxms / 4 + 1; + iaxs[callno]->peerpoke = peer; + struct iax_ie_data ied = { .buf = { 0 }, .pos = 0, |