Fix dialplan function NULL channel safety issues

(closes issue ASTERISK-23391)
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/3386/
........

Merged revisions 411313 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 411314 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 411315 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@411328 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1 files changed, 26 insertions, 2 deletions

diff --git a/funcs/func_channel.c b/funcs/func_channel.c
index af9a6a984..cca15c308 100644
--- a/funcs/func_channel.c
+++ b/funcs/func_channel.c
@@ -421,6 +421,11 @@ static int func_channel_read(struct ast_channel *chan, const char *function,
 	int ret = 0;
 	struct ast_format_cap *tmpcap;
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+		return -1;
+	}
+
 	if (!strcasecmp(data, "audionativeformat")) {
 		char tmp[512];
 
@@ -733,6 +738,11 @@ static int func_channel_write(struct ast_channel *chan, const char *function, ch
 		.value = value,
 	};
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+		return -1;
+	}
+
 	res = func_channel_write_real(chan, function, data, value);
 	ast_channel_setoption(chan, AST_OPTION_CHANNEL_WRITE, &write_info, sizeof(write_info), 0);
 
@@ -806,8 +816,15 @@ static struct ast_custom_function channels_function = {
 static int func_mchan_read(struct ast_channel *chan, const char *function,
 			     char *data, struct ast_str **buf, ssize_t len)
 {
-	struct ast_channel *mchan = ast_channel_get_by_name(ast_channel_linkedid(chan));
+	struct ast_channel *mchan;
 	char *template = ast_alloca(4 + strlen(data));
+
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+		return -1;
+	}
+
+	mchan = ast_channel_get_by_name(ast_channel_linkedid(chan));
 	sprintf(template, "${%s}", data); /* SAFE */
 	ast_str_substitute_variables(buf, len, mchan ? mchan : chan, template);
 	if (mchan) {
@@ -819,7 +836,14 @@ static int func_mchan_read(struct ast_channel *chan, const char *function,
 static int func_mchan_write(struct ast_channel *chan, const char *function,
 			      char *data, const char *value)
 {
-	struct ast_channel *mchan = ast_channel_get_by_name(ast_channel_linkedid(chan));
+	struct ast_channel *mchan;
+
+	if (!chan) {
+		ast_log(LOG_WARNING, "No channel was provided to %s function.\n", function);
+		return -1;
+	}
+
+	mchan = ast_channel_get_by_name(ast_channel_linkedid(chan));
 	pbx_builtin_setvar_helper(mchan ? mchan : chan, data, value);
 	if (mchan) {
 		ast_channel_unref(mchan);