res_fax.c: Fix deadlock potential in FAXOPT(faxdetect) framehook.

The fax_detect_framehook() has the potential to deadlock if an incoming
fax happens during the Playback or similar application.

* Fixed the potential deadlock by not calling ast_async_goto() with the
channel lock held.

* Made always eat the fax detection frame whether there is a fax extension
or not.

* Made only detach the framehook if we detected a fax and not on other
possible frames.

ASTERISK-26216
Reported by: Richard Mudgett

Change-Id: I99da35c26d1cd802626ffb4c1b4eb5b015581b6d

1 files changed, 13 insertions, 7 deletions

diff --git a/res/res_fax.c b/res/res_fax.c
index 347168e56..0c02c8b59 100644
--- a/res/res_fax.c
+++ b/res/res_fax.c
@@ -3701,30 +3701,36 @@ static struct ast_frame *fax_detect_framehook(struct ast_channel *chan, struct a
 	}
 
 	if (result) {
-		const char *target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan));
+		const char *target_context;
+
 		switch (result) {
 		case 'f':
 		case 't':
+			target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan));
+
 			ast_channel_unlock(chan);
+			ast_frfree(f);
+			f = &ast_null_frame;
 			if (ast_exists_extension(chan, target_context, "fax", 1,
 			    S_COR(ast_channel_caller(chan)->id.number.valid, ast_channel_caller(chan)->id.number.str, NULL))) {
-				ast_channel_lock(chan);
 				ast_verb(2, "Redirecting '%s' to fax extension due to %s detection\n",
 					ast_channel_name(chan), (result == 'f') ? "CNG" : "T38");
 				pbx_builtin_setvar_helper(chan, "FAXEXTEN", ast_channel_exten(chan));
 				if (ast_async_goto(chan, target_context, "fax", 1)) {
 					ast_log(LOG_NOTICE, "Failed to async goto '%s' into fax of '%s'\n", ast_channel_name(chan), target_context);
 				}
-				ast_frfree(f);
-				f = &ast_null_frame;
 			} else {
-				ast_channel_lock(chan);
 				ast_log(LOG_NOTICE, "FAX %s detected but no fax extension in context (%s)\n",
 					(result == 'f') ? "CNG" : "T38", target_context);
 			}
+			ast_channel_lock(chan);
+
+			ast_framehook_detach(chan, details->faxdetect_id);
+			details->faxdetect_id = -1;
+			break;
+		default:
+			break;
 		}
-		ast_framehook_detach(chan, details->faxdetect_id);
-		details->faxdetect_id = -1;
 	}
 
 	return f;