Fix dialplan function NULL channel safety issues

(closes issue ASTERISK-23391)
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/3386/
........

Merged revisions 411313 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 411314 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 411315 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@411328 65c4cc65-6c06-0410-ace0-fbb531ad65f3

3 files changed, 52 insertions, 10 deletions

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 185abfc1c..a83152b0e 100644
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -9872,10 +9872,16 @@ static int socket_process_meta(int packet_len, struct ast_iax2_meta_hdr *meta, s
 
 static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-	struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+	struct ast_datastore *variablestore;
 	AST_LIST_HEAD(, ast_var_t) *varlist;
 	struct ast_var_t *var;
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+
+	variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
 	if (!variablestore) {
 		*buf = '\0';
 		return 0;
@@ -9895,10 +9901,16 @@ static int acf_iaxvar_read(struct ast_channel *chan, const char *cmd, char *data
 
 static int acf_iaxvar_write(struct ast_channel *chan, const char *cmd, char *data, const char *value)
 {
-	struct ast_datastore *variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
+	struct ast_datastore *variablestore;
 	AST_LIST_HEAD(, ast_var_t) *varlist;
 	struct ast_var_t *var;
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+
+	variablestore = ast_channel_datastore_find(chan, &iax2_variable_datastore_info, NULL);
 	if (!variablestore) {
 		variablestore = ast_datastore_alloc(&iax2_variable_datastore_info, NULL);
 		if (!variablestore) {
@@ -14189,8 +14201,9 @@ static int function_iaxpeer(struct ast_channel *chan, const char *cmd, char *dat
 	/* if our channel, return the IP address of the endpoint of current channel */
 	if (!strcmp(peername,"CURRENTCHANNEL")) {
 	        unsigned short callno;
-		if (ast_channel_tech(chan) != &iax2_tech)
+		if (!chan || ast_channel_tech(chan) != &iax2_tech) {
 			return -1;
+		}
 		callno = PTR_TO_CALLNO(ast_channel_tech_pvt(chan));
 		ast_copy_string(buf, !ast_sockaddr_isnull(&iaxs[callno]->addr) ? ast_sockaddr_stringify_addr(&iaxs[callno]->addr) : "", len);
 		return 0;
diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 231f376a8..3d52ce4b8 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -22232,7 +22232,12 @@ static int func_header_read(struct ast_channel *chan, const char *function, char
 	);
 	int i, number, start = 0;
 
- 	if (ast_strlen_zero(data)) {
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+		return -1;
+	}
+
+	if (ast_strlen_zero(data)) {
 		ast_log(LOG_WARNING, "This function requires a header name.\n");
 		return -1;
 	}
@@ -22418,7 +22423,12 @@ static int function_sipchaninfo_read(struct ast_channel *chan, const char *cmd,
 
 	*buf = 0;
 
- 	if (!data) {
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+
+	if (!data) {
 		ast_log(LOG_WARNING, "This function requires a parameter name.\n");
 		return -1;
 	}
diff --git a/channels/pjsip/dialplan_functions.c b/channels/pjsip/dialplan_functions.c
index 817af002d..86148259a 100644
--- a/channels/pjsip/dialplan_functions.c
+++ b/channels/pjsip/dialplan_functions.c
@@ -682,7 +682,7 @@ static int read_pjsip(void *data)
 int pjsip_acf_channel_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
 	struct pjsip_func_args func_args = { 0, };
-	struct ast_sip_channel_pvt *channel = ast_channel_tech_pvt(chan);
+	struct ast_sip_channel_pvt *channel;
 	char *parse = ast_strdupa(data);
 
 	AST_DECLARE_APP_ARGS(args,
@@ -691,6 +691,12 @@ int pjsip_acf_channel_read(struct ast_channel *chan, const char *cmd, char *data
 		AST_APP_ARG(field);
 	);
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+	channel = ast_channel_tech_pvt(chan);
+
 	/* Check for zero arguments */
 	if (ast_strlen_zero(parse)) {
 		ast_log(LOG_ERROR, "Cannot call %s without arguments\n", cmd);
@@ -863,7 +869,14 @@ static int media_offer_write_av(void *obj)
 
 int pjsip_acf_media_offer_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-	struct ast_sip_channel_pvt *channel = ast_channel_tech_pvt(chan);
+	struct ast_sip_channel_pvt *channel;
+
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+
+	channel = ast_channel_tech_pvt(chan);
 
 	if (!strcmp(data, "audio")) {
 		return media_offer_read_av(channel->session, buf, len, AST_FORMAT_TYPE_AUDIO);
@@ -876,13 +889,19 @@ int pjsip_acf_media_offer_read(struct ast_channel *chan, const char *cmd, char *
 
 int pjsip_acf_media_offer_write(struct ast_channel *chan, const char *cmd, char *data, const char *value)
 {
-	struct ast_sip_channel_pvt *channel = ast_channel_tech_pvt(chan);
-
+	struct ast_sip_channel_pvt *channel;
 	struct media_offer_data mdata = {
-		.session = channel->session,
 		.value = value
 	};
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
+		return -1;
+	}
+
+	channel = ast_channel_tech_pvt(chan);
+	mdata.session = channel->session;
+
 	if (!strcmp(data, "audio")) {
 		mdata.media_type = AST_FORMAT_TYPE_AUDIO;
 	} else if (!strcmp(data, "video")) {