From ae091d166a64366913e9932ff9ff26c35cc07694 Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Fri, 20 May 2011 16:46:02 +0000 Subject: Merged revisions 320057 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r320057 | rmudgett | 2011-05-20 11:43:02 -0500 (Fri, 20 May 2011) | 19 lines Crash while transferring a call during DTMF feature timeout. When a call is being attended transferred during the time between AST_FRAME_DTMF_BEGIN and AST_FRAME_DTMF_END, the transferred channel becomes a zombie (so tech data is not available), making ast_dtmf_stream() segfault when it tries to send the DTMF digit (at least with SIP channels). Patch based on feature-end-zombie.patch uploaded by Irontec (license 1256) * Check for zombies when ast_channel_bridge() returns. * Guarantee that the fo parameter value is initialized in ast_channel_bridge() before any returns. (closes issue #19116) Reported by: Irontec Tested by: rmudgett ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@320058 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- main/channel.c | 5 ++--- main/features.c | 12 +++++++++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/main/channel.c b/main/channel.c index 74541ab72..c97268c50 100644 --- a/main/channel.c +++ b/main/channel.c @@ -7272,6 +7272,8 @@ enum ast_bridge_result ast_channel_bridge(struct ast_channel *c0, struct ast_cha char caller_warning = 0; char callee_warning = 0; + *fo = NULL; + if (c0->_bridge) { ast_log(LOG_WARNING, "%s is already in a bridge with %s\n", c0->name, c0->_bridge->name); @@ -7297,9 +7299,6 @@ enum ast_bridge_result ast_channel_bridge(struct ast_channel *c0, struct ast_cha return -1; } - - *fo = NULL; - if (ast_tvzero(config->start_time)) { config->start_time = ast_tvnow(); if (config->start_sound) { diff --git a/main/features.c b/main/features.c index 17dd2b7f7..2fb34384b 100644 --- a/main/features.c +++ b/main/features.c @@ -3660,7 +3660,17 @@ int ast_bridge_call(struct ast_channel *chan,struct ast_channel *peer,struct ast struct ast_channel *other; /* used later */ res = ast_channel_bridge(chan, peer, config, &f, &who); - + + if (ast_test_flag(chan, AST_FLAG_ZOMBIE) + || ast_test_flag(peer, AST_FLAG_ZOMBIE)) { + /* Zombies are present time to leave! */ + res = -1; + if (f) { + ast_frfree(f); + } + goto before_you_go; + } + /* When frame is not set, we are probably involved in a situation where we've timed out. When frame is set, we'll come this code twice; once for DTMF_BEGIN -- cgit v1.2.3