From 628e8c91d5c6a3e745bdb37e6593fd838b006393 Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Tue, 12 Jul 2016 17:33:29 -0500 Subject: res_fax.c: Fix deadlock potential in FAXOPT(faxdetect) framehook. The fax_detect_framehook() has the potential to deadlock if an incoming fax happens during the Playback or similar application. * Fixed the potential deadlock by not calling ast_async_goto() with the channel lock held. * Made always eat the fax detection frame whether there is a fax extension or not. * Made only detach the framehook if we detected a fax and not on other possible frames. ASTERISK-26216 Reported by: Richard Mudgett Change-Id: I99da35c26d1cd802626ffb4c1b4eb5b015581b6d --- res/res_fax.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'res/res_fax.c') diff --git a/res/res_fax.c b/res/res_fax.c index ad6e2386c..ba4fc4680 100644 --- a/res/res_fax.c +++ b/res/res_fax.c @@ -3701,30 +3701,36 @@ static struct ast_frame *fax_detect_framehook(struct ast_channel *chan, struct a } if (result) { - const char *target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan)); + const char *target_context; + switch (result) { case 'f': case 't': + target_context = S_OR(ast_channel_macrocontext(chan), ast_channel_context(chan)); + ast_channel_unlock(chan); + ast_frfree(f); + f = &ast_null_frame; if (ast_exists_extension(chan, target_context, "fax", 1, S_COR(ast_channel_caller(chan)->id.number.valid, ast_channel_caller(chan)->id.number.str, NULL))) { - ast_channel_lock(chan); ast_verb(2, "Redirecting '%s' to fax extension due to %s detection\n", ast_channel_name(chan), (result == 'f') ? "CNG" : "T38"); pbx_builtin_setvar_helper(chan, "FAXEXTEN", ast_channel_exten(chan)); if (ast_async_goto(chan, target_context, "fax", 1)) { ast_log(LOG_NOTICE, "Failed to async goto '%s' into fax of '%s'\n", ast_channel_name(chan), target_context); } - ast_frfree(f); - f = &ast_null_frame; } else { - ast_channel_lock(chan); ast_log(LOG_NOTICE, "FAX %s detected but no fax extension in context (%s)\n", (result == 'f') ? "CNG" : "T38", target_context); } + ast_channel_lock(chan); + + ast_framehook_detach(chan, details->faxdetect_id); + details->faxdetect_id = -1; + break; + default: + break; } - ast_framehook_detach(chan, details->faxdetect_id); - details->faxdetect_id = -1; } return f; -- cgit v1.2.3