From aaa715bfae8dd41aeb922a2ed9406fe066016ad9 Mon Sep 17 00:00:00 2001
From: Matthew Jordan <mjordan@digium.com>
Date: Wed, 14 Dec 2011 22:08:55 +0000
Subject: [PATCH] Fixed Asterisk crash when function QUEUE_MEMBER receives
 invalid input

The function QUEUE_MEMBER has two required parameters (queuename, option).  It
was only checking for the presence of queuename.  The patch checks for the
existence of the option parameter and provides better error logging when
invalid values are provided for the option parameter as well.
........

Merged revisions 348211 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@348215 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 apps/app_queue.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/apps/app_queue.c b/apps/app_queue.c
index 8d15123998..fe8723c54c 100644
--- a/apps/app_queue.c
+++ b/apps/app_queue.c
@@ -6372,12 +6372,17 @@ static int queue_function_mem_read(struct ast_channel *chan, const char *cmd, ch
 	buf[0] = '\0';
 
 	if (ast_strlen_zero(data)) {
-		ast_log(LOG_ERROR, "%s requires an argument: queuename\n", cmd);
+		ast_log(LOG_ERROR, "Missing required argument. %s(<queuename>,<option>[<interface>])\n", cmd);
 		return -1;
 	}
 
 	AST_STANDARD_APP_ARGS(args, data);
 
+	if (args.argc < 2) {
+		ast_log(LOG_ERROR, "Missing required argument. %s(<queuename>,<option>[<interface>])\n", cmd);
+		return -1;
+	}
+
 	if ((q = find_load_queue_rt_friendly(args.queuename))) {
 		ao2_lock(q);
 		if (!strcasecmp(args.option, "logged")) {
@@ -6427,6 +6432,9 @@ static int queue_function_mem_read(struct ast_channel *chan, const char *cmd, ch
 			   ((m = interface_exists(q, args.interface)))) {
 			count = m->ignorebusy;
 			ao2_ref(m, -1);
+		} else {
+			ast_log(LOG_ERROR, "Unknown option %s provided to %s, valid values are: "
+				"logged, free, ready, count, penalty, paused, ignorebusy\n", args.option, cmd);
 		}
 		ao2_unlock(q);
 		queue_t_unref(q, "Done with temporary reference in QUEUE_MEMBER()");