From c2447e0cc8124a5260c7456816f743f09d86cfd6 Mon Sep 17 00:00:00 2001 From: Sean Bright Date: Thu, 19 Apr 2012 15:53:56 +0000 Subject: [PATCH] Prevent a crash in ExternalIVR when the 'S' command is sent first. If the first command sent from an ExternalIVR client is an 'S' command, we were blindly removing the first element from the play list and deferencing it, even if it was NULL. This corrects that and also locks appropriately in one place. (issue ASTERISK-17889) Reported by: Chris Maciejewski git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362586 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- apps/app_externalivr.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/apps/app_externalivr.c b/apps/app_externalivr.c index b91fc5025e..b05baed7bc 100644 --- a/apps/app_externalivr.c +++ b/apps/app_externalivr.c @@ -682,13 +682,14 @@ static int eivr_comm(struct ast_channel *chan, struct ivr_localuser *u, if (f->frametype == AST_FRAME_DTMF) { send_eivr_event(eivr_events, f->subclass.integer, NULL, chan); if (u->option_autoclear) { + AST_LIST_LOCK(&u->playlist); if (!u->abort_current_sound && !u->playing_silence) { /* send interrupted file as T data */ - entry = AST_LIST_REMOVE_HEAD(&u->playlist, list); - send_eivr_event(eivr_events, 'T', entry->filename, chan); - ast_free(entry); + if ((entry = AST_LIST_REMOVE_HEAD(&u->playlist, list))) { + send_eivr_event(eivr_events, 'T', entry->filename, chan); + ast_free(entry); + } } - AST_LIST_LOCK(&u->playlist); while ((entry = AST_LIST_REMOVE_HEAD(&u->playlist, list))) { send_eivr_event(eivr_events, 'D', entry->filename, chan); ast_free(entry); @@ -767,9 +768,10 @@ static int eivr_comm(struct ast_channel *chan, struct ivr_localuser *u, AST_LIST_LOCK(&u->playlist); if (!u->abort_current_sound && !u->playing_silence) { /* send interrupted file as T data */ - entry = AST_LIST_REMOVE_HEAD(&u->playlist, list); - send_eivr_event(eivr_events, 'T', entry->filename, chan); - ast_free(entry); + if ((entry = AST_LIST_REMOVE_HEAD(&u->playlist, list))) { + send_eivr_event(eivr_events, 'T', entry->filename, chan); + ast_free(entry); + } } while ((entry = AST_LIST_REMOVE_HEAD(&u->playlist, list))) { send_eivr_event(eivr_events, 'D', entry->filename, chan);