diff options
| author | Corey Farrell <git@cfware.com> | 2015-06-08 11:09:22 -0400 |
|---|---|---|
| committer | Corey Farrell <git@cfware.com> | 2015-06-08 11:09:22 -0400 |
| commit | 55c8daf88b94f74e334ab246c51bdb7b469eedc4 (patch) | |
| tree | 8c79fa393e6f2427929d2f89bf0bd4ee03b25a09 /channels | |
| parent | 720251f2b80639324a37b2041997292d97858d39 (diff) | |
Fix unsafe uses of ast_context pointers.
Although ast_context_find, ast_context_find_or_create and
ast_context_destroy perform locking of the contexts table,
any context pointer can become invalid at any time that the
contexts table is unlocked. This change adds locking around
all complete operations involving these functions.
Places where ast_context_find was followed by ast_context_destroy
have been replaced with calls ast_context_destroy_by_name.
ASTERISK-25094 #close
Reported by: Corey Farrell
Change-Id: I1866b6787730c9c4f3f836b6133ffe9c820734fa
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_iax2.c | 5 | ||||
| -rw-r--r-- | channels/chan_sip.c | 9 | ||||
| -rw-r--r-- | channels/chan_skinny.c | 8 |
3 files changed, 5 insertions, 17 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index dc30d9fe7..6e8e9e4f7 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -14636,7 +14636,6 @@ static void cleanup_thread_list(void *head) static int __unload_module(void) { - struct ast_context *con; int x; network_change_stasis_unsubscribe(); @@ -14713,9 +14712,7 @@ static int __unload_module(void) sched = NULL; ao2_ref(peercnts, -1); - con = ast_context_find(regcontext); - if (con) - ast_context_destroy(con, "IAX2"); + ast_context_destroy_by_name(regcontext, "IAX2"); ast_unload_realtime("iaxpeers"); ao2_ref(iax2_tech.capabilities, -1); diff --git a/channels/chan_sip.c b/channels/chan_sip.c index b1fbd6e9b..5be0200ed 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -19750,8 +19750,7 @@ static void cleanup_stale_contexts(char *new, char *old) } } - if (stalecontext) - ast_context_destroy(ast_context_find(stalecontext), "SIP"); + ast_context_destroy_by_name(stalecontext, "SIP"); } } @@ -34540,7 +34539,6 @@ static int unload_module(void) { struct sip_pvt *p; struct sip_threadinfo *th; - struct ast_context *con; struct ao2_iterator i; int wait_count; @@ -34718,10 +34716,7 @@ static int unload_module(void) close(sipsock); io_context_destroy(io); ast_sched_context_destroy(sched); - con = ast_context_find(used_context); - if (con) { - ast_context_destroy(con, "SIP"); - } + ast_context_destroy_by_name(used_context, "SIP"); ast_unload_realtime("sipregs"); ast_unload_realtime("sippeers"); ast_cc_monitor_unregister(&sip_cc_monitor_callbacks); diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c index be9f9b67e..3d2d2e8d1 100644 --- a/channels/chan_skinny.c +++ b/channels/chan_skinny.c @@ -2198,8 +2198,7 @@ static void cleanup_stale_contexts(char *new, char *old) } } - if (stalecontext) - ast_context_destroy(ast_context_find(stalecontext), "Skinny"); + ast_context_destroy_by_name(stalecontext, "Skinny"); } } @@ -8710,7 +8709,6 @@ static int unload_module(void) struct skinny_device *d; struct skinny_line *l; struct skinny_subchannel *sub; - struct ast_context *con; pthread_t tempthread; ast_rtp_glue_unregister(&skinny_rtp_glue); @@ -8771,9 +8769,7 @@ static int unload_module(void) ast_sched_context_destroy(sched); } - con = ast_context_find(used_context); - if (con) - ast_context_destroy(con, "Skinny"); + ast_context_destroy_by_name(used_context, "Skinny"); ao2_ref(default_cap, -1); return 0; |