Merged revisions 324634 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.6.2

................
  r324634 | dvossel | 2011-06-23 13:18:46 -0500 (Thu, 23 Jun 2011) | 13 lines
  
  Merged revisions 324627 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r324627 | dvossel | 2011-06-23 13:16:52 -0500 (Thu, 23 Jun 2011) | 7 lines
    
    Addresses AST-2011-010, remote crash in IAX2 driver
    
    Thanks to twilson for identifying the issue and providing the patches.
    
    AST-2011-010
  ........
................


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@324652 65c4cc65-6c06-0410-ace0-fbb531ad65f3
certified/1.8.6
David Vossel 15 years ago
parent 58ff18fbd6
commit e1adc7cefa

@ -5266,10 +5266,6 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat
/* these two cannot be sent, because they require a result */
errno = ENOSYS;
return -1;
case AST_OPTION_FORMAT_READ:
case AST_OPTION_FORMAT_WRITE:
case AST_OPTION_MAKE_COMPATIBLE:
return -1;
case AST_OPTION_OPRMODE:
errno = EINVAL;
return -1;
@ -5286,7 +5282,16 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat
ast_mutex_unlock(&iaxsl[callno]);
return 0;
}
default:
/* These options are sent to the other side across the network where
* they will be passed to whatever channel is bridged there. Don't
* do anything silly like pass an option that transmits pointers to
* memory on this machine to a remote machine to use */
case AST_OPTION_TONE_VERIFY:
case AST_OPTION_TDD:
case AST_OPTION_RELAXDTMF:
case AST_OPTION_AUDIO_MODE:
case AST_OPTION_DIGIT_DETECT:
case AST_OPTION_FAX_DETECT:
{
unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
struct chan_iax2_pvt *pvt;
@ -5314,7 +5319,12 @@ static int iax2_setoption(struct ast_channel *c, int option, void *data, int dat
ast_free(h);
return res;
}
default:
return -1;
}
/* Just in case someone does a break instead of a return */
return -1;
}
static int iax2_queryoption(struct ast_channel *c, int option, void *data, int *datalen)

@ -404,45 +404,51 @@ enum ast_control_transfer {
#define AST_OPTION_FLAG_WTF 6
/*! Verify touchtones by muting audio transmission
(and reception) and verify the tone is still present */
* (and reception) and verify the tone is still present
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_TONE_VERIFY 1
/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode */
/*! Put a compatible channel into TDD (TTY for the hearing-impared) mode
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_TDD 2
/*! Relax the parameters for DTMF reception (mainly for radio use) */
/*! Relax the parameters for DTMF reception (mainly for radio use)
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_RELAXDTMF 3
/*! Set (or clear) Audio (Not-Clear) Mode */
/*! Set (or clear) Audio (Not-Clear) Mode
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_AUDIO_MODE 4
/*! Set channel transmit gain
* Option data is a single signed char
representing number of decibels (dB)
to set gain to (on top of any gain
specified in channel driver)
*/
* Option data is a single signed char representing number of decibels (dB)
* to set gain to (on top of any gain specified in channel driver) */
#define AST_OPTION_TXGAIN 5
/*! Set channel receive gain
* Option data is a single signed char
representing number of decibels (dB)
to set gain to (on top of any gain
specified in channel driver)
*/
* Option data is a single signed char representing number of decibels (dB)
* to set gain to (on top of any gain specified in channel driver) */
#define AST_OPTION_RXGAIN 6
/* set channel into "Operator Services" mode */
/* set channel into "Operator Services" mode
* Option data is a struct oprmode
*
* \note This option should never be sent over the network */
#define AST_OPTION_OPRMODE 7
/*! Explicitly enable or disable echo cancelation for the given channel */
/*! Explicitly enable or disable echo cancelation for the given channel
* Option data is a single signed char value 0 or 1
*
* \note This option appears to be unused in the code. It is handled, but never
* set or queried. */
#define AST_OPTION_ECHOCAN 8
/*! \brief Handle channel write data
* If a channel needs to process the data from a func_channel write operation
* after func_channel_write executes, it can define the setoption callback
* and process this option. A pointer to an ast_chan_write_info_t will be passed.
* */
*
* \note This option should never be passed over the network. */
#define AST_OPTION_CHANNEL_WRITE 9
/* !
@ -451,28 +457,38 @@ enum ast_control_transfer {
*/
#define AST_OPTION_T38_STATE 10
/*! Request that the channel driver deliver frames in a specific format */
/*! Request that the channel driver deliver frames in a specific format
* Option data is a format_t */
#define AST_OPTION_FORMAT_READ 11
/*! Request that the channel driver be prepared to accept frames in a specific format */
/*! Request that the channel driver be prepared to accept frames in a specific format
* Option data is a format_t */
#define AST_OPTION_FORMAT_WRITE 12
/*! Request that the channel driver make two channels of the same tech type compatible if possible */
/*! Request that the channel driver make two channels of the same tech type compatible if possible
* Option data is an ast_channel
*
* \note This option should never be passed over the network */
#define AST_OPTION_MAKE_COMPATIBLE 13
/*! Get or set the digit detection state of the channel */
/*! Get or set the digit detection state of the channel
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_DIGIT_DETECT 14
/*! Get or set the fax tone detection state of the channel */
/*! Get or set the fax tone detection state of the channel
* Option data is a single signed char value 0 or 1 */
#define AST_OPTION_FAX_DETECT 15
/*! Get the device name from the channel */
/*! Get the device name from the channel (Read only)
* Option data is a character buffer of suitable length */
#define AST_OPTION_DEVICE_NAME 16
/*! Get the CC agent type from the channel */
/*! Get the CC agent type from the channel (Read only)
* Option data is a character buffer of suitable length */
#define AST_OPTION_CC_AGENT_TYPE 17
/*! Get or set the security options on a channel */
/*! Get or set the security options on a channel
* Option data is an integer value of 0 or 1 */
#define AST_OPTION_SECURE_SIGNALING 18
#define AST_OPTION_SECURE_MEDIA 19

@ -3707,10 +3707,21 @@ int ast_bridge_call(struct ast_channel *chan,struct ast_channel *peer,struct ast
break;
case AST_CONTROL_OPTION:
aoh = f->data.ptr;
/* Forward option Requests */
/* Forward option Requests, but only ones we know are safe
* These are ONLY sent by chan_iax2 and I'm not convinced that
* they are useful. I haven't deleted them entirely because I
* just am not sure of the ramifications of removing them. */
if (aoh && aoh->flag == AST_OPTION_FLAG_REQUEST) {
ast_channel_setoption(other, ntohs(aoh->option), aoh->data,
f->datalen - sizeof(struct ast_option_header), 0);
switch (ntohs(aoh->option)) {
case AST_OPTION_TONE_VERIFY:
case AST_OPTION_TDD:
case AST_OPTION_RELAXDTMF:
case AST_OPTION_AUDIO_MODE:
case AST_OPTION_DIGIT_DETECT:
case AST_OPTION_FAX_DETECT:
ast_channel_setoption(other, ntohs(aoh->option), aoh->data,
f->datalen - sizeof(struct ast_option_header), 0);
}
}
break;
}

Loading…
Cancel
Save