asterisk

Commit Graph

Author	SHA1	Message	Date
Richard Mudgett	186a89e99c	Fix local channel chains optimizing themselves out of a call. * Made chan_local.c:check_bridge() check the return value of ast_channel_masquerade(). In long chains of local channels, the masquerade occasionally fails to get setup because there is another masquerade already setup on an adjacent local channel in the chain. * Made the outgoing local channel (the ;2 channel) flush one voice or video frame per optimization attempt. * Made sure that the outgoing local channel also does not have any frames in its queue before the masquerade. * Made do the masquerade immediately to minimize the chance that the outgoing channel queue does not get any new frames added and thus unconditionally flushed. * Made block indication -1 (Stop tones) event when the local channel is going to optimize itself out. When the call is answered, a chain of local channels pass down a -1 indication for each bridge. This blizzard of -1 events really slows down the optimization process. (closes issue ASTERISK-16711) Reported by: Alec Davis Tested by: rmudgett, Alec Davis Review: https://reviewboard.asterisk.org/r/1894/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365313 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Michelson	c6d9524482	Fix core FINDING 2, FINDING 3, and FINDING 4 from Coverity's CONSTANT_EXPRESSION_RESULT report. These three all are in RTP code that attempts to print the number of sequence number cycles in an RTCP RR report. The code was masking out the upper 16 bits and then shifting the number right by 16 bits. This led to an all zero result in all cases. The fix is to do the shift without the bit masking. (issue ASTERISK-19649) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365298 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Alexandr Anikin	4bddfcf335	Fix warning of Coverity Static analysis, change H225ProtocolIdentifier from value to pointer per functions that use this. (close issue ASTERISK-19670) Reported by: Matt Jordan Patches: ASTERISK-19670.patch (License #5415) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365159 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Alexandr Anikin	0b9bca22bd	Fix coverity static analysis warning, allocate full ie structure instead of without data buffer (close issue ASTERISK-19674) Reported by: Matt Jordan Patches: ASTERISK-19674.patch (License #5415) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365143 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	c068460b12	Don't leak a ref if out of memory and can't link the linkedid If the ao2_link fails, we are most likely out of memory and bad things are going to happen. Before those bad things happen, make sure to clean up the linkedid references. This patch also adds a comment explaining why linkedid can't be passed to both local channel allocations and combines two ao2_ref calls into 1. Review: https://reviewboard.asterisk.org/r/1895/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365068 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	7da21c68c4	Fix a CEL LINKEDID_END race and local channel linkedids This patch has the ;2 channel inherit the linkedid of the ;1 channel and fixes the race condition by no longer scanning the channel list for "other" channels with the same linkedid. Instead, cel.c has an ao2 container of linkedid strings and uses the refcount of the string as a counter of how many channels with the linkedid exist. Not only does this eliminate the race condition, but it also allows us to look up the linkedid by the hashed key instead of traversing the entire channel list. Review: https://reviewboard.asterisk.org/r/1895/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@365006 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	a11540c95b	Fixed __ao2_ref() validating user_data twice. (closes issue ASTERISK-19755) Reported by: Gunther Kelleter Patches: ao2_ref.patch (license #6372) patch uploaded by Gunther Kelleter git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364902 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Michelson	095054e4a1	Fix Coverity-reported ARRAY_VS_SINGLETON error. As it turned out, this wasn't a huge deal. We were calling ast_app_parse_options() for a set of options of which none took arguments. The proper thing to do for this case is to pass NULL for the "args" parameter here. We were instead passing a seemingly-randomly chosen char * from the function. While this would never get written to, you can rest assured things would have gotten bad had new options (which took arguments) been added to func_volume. (closes issue ASTERISK-19656) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364899 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Jason Parker	be16f2da64	Prevent a potential crash when using manager hooks. Found by me while poking at DPMA-127. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364841 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	fde9505a95	* Fix error path resouce leak in local_request(). * Restructure local_request() to reduce indentation. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364840 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Kinsey Moore	dcd64542bc	Play conf-placeintoconf message to the correct channel Correct the code in app_confbridge to play the conf-placeintoconf message to the marked user entering the bridge instead of to the conference while the marked user hears silence. (closes issue ASTERISK-19641) Reported-by: Mark A Walters git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364786 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Jonathan Rose	5b45764bb7	Fix bad check in voicemail functions for ast_inboxcount2_func Check looks for ast_inboxcount_func instead of ast_inboxcount2_func on ast_inboxcount2_func calls. (closes issue ASTERISK-19718) Reported by: Corey Farrell Patches: ast_app_inboxcount2-null-refcheck.patch uploaded by Corey Farrell (license 5909) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364769 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Michelson	dba70c1340	Revert improved identities sent in dialog-info NOTIFY requests in r360862 Revision 360862 was intended to improve identities sent in dialog-info NOTIFY requests. Some users reported that hint became broken once this was done. It's not clear exactly what part of the patch has caused this regression, but broken hints are bad. For now, this revision is being reverted so that the next releases of Asterisk do not have bad behavior in them. The original reported issue will have to be fixed differently in the next version of Asterisk. (issue ASTERISK-16735) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364706 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Alexandr Anikin	97787d8c5e	Fix use freed pointer in return value from call thread (issue ASTERISK-19663) Reported by: Matt Jordan Patches: ASTERISK-19663-ooh323.patch (License #5415) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364649 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Murawki	2a6bdce6b4	Sanatize result from bfd_find_nearest_line (BETTER_BACKTRACES) bfd_find_nearest_line can possibly set file to null resulting in a crash when strrchr(file) runs (closes issue ASTERISK-19815) Reported by Mark Murawski Tested by Mark Murawski git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364635 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	f248f6eb71	Fix error that caused truncate operations to fail Another very inappropriate placement of a ')' (again introduced in r362151) caused the various truncate operations to attempt to truncate the sound file at a position of '0'. (issue ASTERISK-19655) Reported by: Matt Jordan (issue ASTERISK-19810) Reported by: colbec git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364578 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Michelson	139a7459cd	Don't attempt to make use of the dynamic_exclude_static ACL if DNS lookup fails. (closes issue ASTERISK-18321) Reported by Dan Lukes Patches: ASTERISK-18321.patch by Mark Michelson (license #5049) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364341 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	f0eb58d0d5	Fix ast_parse_arg numeric type range checking and add tests ast_parse_arg wasn't checking for strto* parse errors or limiting the results by the actual range of the numeric types. This patch fixes that and adds unit tests as well. Review: https://reviewboard.asterisk.org/r/1879/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364340 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	c527c4d197	Prevent overflow in calculation in ast_tvdiff_ms on 32-bit machines The method ast_tvdiff_ms attempts to calculate the difference, in milliseconds, between two timeval structs, and return the difference in a 64-bit integer. Unfortunately, it assumes that the long tv_sec/tv_usec members in the timeval struct are large enough to hold the calculated values before it returns. On 64-bit machines, this might be the case, as a long may be 64-bits. On 32-bit machines, however, a long may be less (32-bits), in which case, the calculation can overflow. This overflow caused significant problems in MixMonitor, which uses the method to determine if an audio factory, which has not presented audio to an audiohook, is merely late in providing said audio or will never provide audio. In an overflow situation, the audiohook would incorrectly determine that an audio factory that will never provide audio is merely late instead. This led to situations where a MixMonitor never recorded any audio. Note that this happened most frequently when that MixMonitor was started by the ConfBridge application itself, or when the MixMonitor was attached to a Local channel. (issue ASTERISK-19497) Reported by: Ben Klang Tested by: Ben Klang Patches: 32-bit-time-overflow-10-2012-04-26.diff (license #6283) by mjordan (closes issue ASTERISK-19727) Reported by: Mark Murawski Tested by: Michael L. Young Patches: 32-bit-time-overflow-2012-04-27.diff (license #6283) by mjordan) (closes issue ASTERISK-19471) Reported by: feyfre Tested by: feyfre (issue ASTERISK-19426) Reported by: Johan Wilfer Review: https://reviewboard.asterisk.org/r/1889/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364277 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Kinsey Moore	0536634ff1	Allow SIP pvts involved in Replaces transfers to fall out of reference sooner Unref the SIP pvt stored in the refer structure as soon as it is no longer needed so that the pvt and associated file descriptors can be freed sooner. This change makes a reference decrement unnecessary in code that handles SIP BYE/Also transfers which should not touch the reference anyway. (Closes issue ASTERISK-19579) Reported by: Maciej Krajewski Tested by: Maciej Karjewski git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364258 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	3ef885b576	Allow for reloading SRTP crypto keys within the same SIP dialog As a continuation of the patch in r356604, which allowed for the reloading of SRTP keys in re-INVITE transfer scenarios, this patch addresses the more common case where a new key is requested within the context of a current SIP dialog. This can occur, for example, when certain phones request a SIP hold. Previously, once a dialog was associated with an SRTP object, any subsequent attempt to process crypto keys in any SDP offer - either the current one or a new offer in a new SIP request - were ignored. This patch changes this behavior to only ignore subsequent crypto keys within the current SDP offer, but allows future SDP offers to change the keys. (issue ASTERISK-19253) Reported by: Thomas Arimont Tested by: Thomas Arimont Review: https://reviewboard.asteriskorg/r/1885/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364203 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	faec22add3	Update Pickup application documentation. (With feeling this time.) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364108 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	28fef5789b	Fix DTMF atxfer running h exten after the wrong bridge ends. When party B does an attended transfer of party A to party C, the attending bridge between party B and C should not be running an h exten when the bridge ends. Running an h exten now sets a softhangup flag to ensure that an AGI will run in dead AGI mode. * Set the AST_FLAG_BRIDGE_HANGUP_DONT on the party B channel for the attending bridge between party B and C. (closes issue AST-870) (closes issue ASTERISK-19717) Reported by: Mario (closes issue ASTERISK-19633) Reported by: Andrey Solovyev Patches: jira_asterisk_19633_v1.8.patch (license #5621) patch uploaded by rmudgett Tested by: rmudgett, Andrey Solovyev, Mario git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364060 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	bbd95e031d	Add more constness to the end_buf pointer in the netconsole issue ASTERISK-18308 Review: https://reviewboard.asterisk.org/r/1876/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@364046 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Kinsey Moore	c4ed0550e8	Fix reference leaks involving SIP Replaces transfers The reference held for SIP blind transfers using the Replaces header in an INVITE was never freed on success and also failed to be freed in some error conditions. This caused a file descriptor leak since the RTP structures in use at the time of the transfer were never freed. This reference leak and another relating to subscriptions in the same code path have now been corrected. (closes issue ASTERISK-19579) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363986 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Alec L Davis	2ecce90e93	chan_sip: [general] maxforwards, not checked for a value greater than 255 The peer maxforwards is checked for both '< 1' and '> 255', but the default 'maxforwards' in the [general] section is only checked for '< 1' alecdavis (license 585) Reported by: alecdavis Tested by: alecdavis Review: https://reviewboard.asterisk.org/r/1888/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363934 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	d6ab0313c6	Update Pickup application documentation. (Even better) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363875 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	78b487007c	Update Pickup application documentation. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363788 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	1302d291c7	Make DAHDISendCallreroutingFacility wait 5 seconds for a reply before disconnecting the call. Some switches may not handle the call-deflection/call-rerouting message if the call is disconnected too soon after being sent. Asteisk was not waiting for any reply before disconnecting the call. * Added a 5 second delay before disconnecting the call to wait for a potential response if the peer does not disconnect first. (closes issue ASTERISK-19708) Reported by: mehdi Shirazi Patches: jira_asterisk_19708_v1.8.patch (license #5621) patch uploaded by rmudgett Tested by: rmudgett git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363730 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	74a9fcd6c4	Clear ISDN channel resetting state if the peer continues to use it. Some ISDN switches occasionally fail to send a RESTART ACKNOWLEDGE in response to a RESTART request. * Made the second SETUP received after sending a RESTART request clear the channel resetting state as if the peer had sent the expected RESTART ACKNOWLEDGE before continuing to process the SETUP. The peer may not be sending the expected RESTART ACKNOWLEDGE. (issue ASTERISK-19608) (issue AST-844) (issue AST-815) Patches: jira_ast_815_v1.8.patch (license #5621) patch uploaded by rmudgett (modified) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363687 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	262ee9fd02	Fix recalled party B feature flags for a failed DTMF atxfer. 1) B calls A with Dial option T 2) B DTMF atxfer to C 3) B hangs up 4) C does not answer 5) B is called back 6) B answers 7) B cannot initiate transfers anymore * Add dial features datastore to recalled party B channel that is a copy of the original party B channel's dial features datastore. * Extracted add_features_datastore() from add_features_datastores(). * Renamed struct ast_dial_features features_caller and features_callee members to my_features and peer_features respectively. These better names eliminate the need for some explanatory comments. * Simplified code accessing the struct ast_dial_features datastore. (closes issue ASTERISK-19383) Reported by: lgfsantos git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363428 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	0dbc13d013	Hangup affected channel in error paths of bridge_call_thread(). git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363375 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Tilghman Lesher	233b8364d3	On some platforms, O_RDONLY is not a flag to be checked, but merely the absence of O_RDWR and O_WRONLY. The POSIX specification does not mandate how these 3 flags must be specified, only that one of the three must be specified in every call. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363209 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Jonathan Rose	7c6c99c317	AST-2012-004: Fix an error that allows AMI users to run shell commands sans authorization. As detailed in the advisory, AMI users without write authorization for SYSTEM class AMI actions were able to run system commands by going through other AMI commands which did not require that authorization. Specifically, GetVar and Status allowed users to do this by setting their variable/s options to the SHELL or EVAL functions. Also, within 1.8, 10, and trunk there was a similar flaw with the Originate action that allowed users with originate permission to run MixMonitor and supply a shell command in the Data argument. That flaw is fixed in those versions of this patch. (closes issue ASTERISK-17465) Reported By: David Woolley Patches: 162_ami_readfunc_security_r2.diff uploaded by jrose (license 6182) 18_ami_readfunc_security_r2.diff uploaded by jrose (license 6182) 10_ami_readfunc_security_r2.diff uploaded by jrose (license 6182) ........ Merged revisions 363117 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363141 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	88f80c1d54	AST-2012-006: Fix crash in UPDATE handling when no channel owner exists If Asterisk receives a SIP UPDATE request after a call has been terminated and the channel has been destroyed but before the SIP dialog has been destroyed, a condition exists where a connected line update would be attempted on a non-existing channel. This would cause Asterisk to crash. The patch resolves this by first ensuring that the SIP dialog has an owning channel before attempting a connected line update. If an UPDATE request is received and no channel is associated with the dialog, a 481 response is sent. (closes issue ASTERISK-19770) Reported by: Thomas Arimont Tested by: Matt Jordan Patches: ASTERISK-19278-2012-04-16.diff uploaded by Matt Jordan (license 6283) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363106 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	9a3120c0c8	AST-2012-005: Fix remotely exploitable heap overflow in keypad button handling When handling a keypad button message event, the received digit is placed into a fixed length buffer that acts as a queue. When a new message event is received, the length of that buffer is not checked before placing the new digit on the end of the queue. The situation exists where sufficient keypad button message events would occur that would cause the buffer to be overrun. This patch explicitly checks that there is sufficient room in the buffer before appending a new digit. (closes issue ASTERISK-19592) Reported by: Russell Bryant ........ Merged revisions 363100 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@363102 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	93304431a3	Update app_dial M and U option GOTO return value documentation. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362997 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	fe7f595e9b	OpenBSD doesn't have rawmemchr, use strchr (closes issue ASTERISK-19758) Reported by: Barry Miller Tested by: Terry Wilson Patches: 362758-diff uploaded by Barry Miller (license 5434) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362868 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	e07ff6ed84	Document Speech* apps hangup on failure and suggest TryExec The Speech API apps return -1 on failure, which will hang up the channel. This may not be desirable behavior for some, but it isn't something that can be changed without breaking people's dialplans or writing an option to all of the Speech apps that does what TryExec already does. This patch documents the hangup behavior of the apps, and suggests TryExec as the solution. (closes issue AST-813) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362815 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Walter Doekes	a59edad230	Fix documentation for ${VERSION(ASTERISK_VERSION_NUM)}. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362729 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Michael L. Young	e49fcbcb04	Add leading and trailing backslashes A couple of unit tests did not have have leading or trailing backslashes when setting their test category resulting in a warning message being displayed. Added the backslash where needed. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362680 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	f1bb4eea3d	Update membermacro and membergosub documentation in queues.conf.sample. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362677 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Sean Bright	c2447e0cc8	Prevent a crash in ExternalIVR when the 'S' command is sent first. If the first command sent from an ExternalIVR client is an 'S' command, we were blindly removing the first element from the play list and deferencing it, even if it was NULL. This corrects that and also locks appropriately in one place. (issue ASTERISK-17889) Reported by: Chris Maciejewski git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362586 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	07a9b1744d	Handle multiple commands per connection via netconsole Asterisk would accept multiple NULL-delimited CLI commands via the netconsole socket, but would occasionally miss a command due to the command not being completely read into the buffer. This patch ensures that any partial commands get moved to the front of the read buffer, appended to, and properly sent. (closes issue ASTERISK-18308) Review: https://reviewboard.asterisk.org/r/1876/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362536 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	0e488d7cc4	Fix a variety of potential buffer overflows * chan_mobile: Fixed an overrun where the cind_state buffer (an integer array of size 16) would be overrun due to improper bounds checking. At worst, the buffer can be overrun by a total of 48 bytes (assuming 4-byte integers), which would still leave it within the allocated memory of struct hfp. This would corrupt other elements in that struct but not necessarily cause any further issues. * app_sms: The array imsg is of size 250, while the array (ud) that the data is copied into is of size 160. If the size of the inbound message is greater then 160, up to 90 bytes could be overrun in ud. This would corrupt the user data header (array udh) adjacent to ud. * chan_unistim: A number of invalid memmoves are corrected. These would move data (which may or may not be valid) into the ends of these buffers. * asterisk: ast_console_toggle_loglevel does not check that the console log level being set is less then or equal to the allowed log levels of 32. * frame: In ast_codec_pref_prepend, if any occurrence of the specified codec is not found, the value used to index into the array pref->order would be one greater then the maximum size of the array. * jitterbuf: If the element being placed into the jitter buffer lands in the last available slot in the jitter history buffer, the insertion sort attempts to move the last entry in the buffer into one slot past the maximum length of the buffer. Note that this occurred for both the min and max jitter history buffers. * tdd: If a read from fsk_serial returns a character that is greater then 32, an attempt to read past one of the statically defined arrays containing the values that character maps to would occur. * localtime: struct ast_time and tm are not the same size - ast_time is larger, although it contains the elements of tm within it in the same layout. Hence, when using memcpy to copy the contents of tm into ast_time, the size of tm should be used, as opposed to the size of ast_time. * extconf: this treats ast_timing's minmask array as if it had a length of 48, when it has defined the size of the array as 24. pbx.h defines minmask as having a size of 48. (issue ASTERISK-19668) Reported by: Matt Jordan git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362485 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Richard Mudgett	e9a0da476a	Add ability to ignore layer 1 alarms for BRI PTMP lines. Several telcos bring the BRI PTMP layer 1 down when the line is idle. When layer 1 goes down, Asterisk cannot make outgoing calls. Incoming calls could fail as well because the alarm processing is handled by a different code path than the Q.931 messages. * Add the layer1_presence configuration option to ignore layer 1 alarms when the telco brings layer 1 down. This option can be configured by span while the similar DAHDI driver teignorered=1 option is system wide. This option unlike layer2_persistence does not require libpri v1.4.13 or newer. Related to JIRA AST-598 JIRA ABE-2845 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362428 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	7c0583212e	Handle case where an unknown format is used to get the preferred codec size In ast_codec_pref_getsize, if an unknown format is passed to the method, no preferred codec will be selected and a negative number will be used to index into the format list. The method now logs an unknown format as a warning, and returns an empty format list. (issue ASTERISK-19655) Reported by: Matt Jordan Review: https://reviewboard.asterisk.org/r/1863/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362368 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	70bde6ffa7	Fix places in resources where a negative return value could impact execution This patch addresses a number of modules in resources that did not handle the negative return value from function calls adequately. This includes: * res_agi.c: if the result of the read function is a negative number, indicating some failure, the result would instead be treated as the number of bytes read. This patch now treats negative results in the same manner as an end of file condition, with the exception that it also logs the error code indicated by the return. * res_musiconhold.c: if spawn_mp3 fails to assign a file descriptor to srcfd, and instead assigns a negative value, that file descriptor could later be passed to functions that require a valid file descriptor. If spawn_mp3 fails, we now immediately retry instead of continuing in the logic. * res_rtp_asterisk.c: if no codec can be matched between two RTP instances in a peer to peer bridge, we immediately return instead of attempting to use the codec payload type as an index to determine the appropriate negotiated codec. (issue ASTERISK-19655) Reported by: Matt Jordan Review: https://reviewboard.asterisk.org/r/1863/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362362 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	0bdbd0d899	Fix places in main where a negative return value could impact execution This patch addresses a number of modules in main that did not handle the negative return value from function calls adequately, or were not sufficiently clear that the conditions leading to improper handling of the return values could not occur. This includes: * asterisk.c: A negative return value from the read function would be used directly as an index into a buffer. We now check for success of the read function prior to using its result as an index. * manager.c: Check for failures in mkstemp and lseek when handling the temporary file created for processing data returned from a CLI command in action_command. Also check that the result of an lseek is sanitized prior to using it as the size of a memory map to allocate. * translate.c: Note in the appropriate locations where powerof cannot return a negative value, due to proper checks placed on the inputs to that function. (issue ASTERISK-19655) Reported by: Matt Jordan Review: https://reviewboard.asterisk.org/r/1863/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362359 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Matthew Jordan	2d7a927c81	Fix places where a negative return from ftello could be used as invalid input In a variety of locations in both reading and writing a file, the result from the C library function ftello is used as input to other functions. For the parameters and functions in question, a negative value is invalid input. This patch checks the return value from the ftello function to determine if we were able to determine the current position in the file stream and, if not, fail gracefully. (issue ASTERISK-19655) Reported by: Matt Jordan Review: https://reviewboard.asterisk.org/r/1863/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@362355 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago

1 2 3 4 5 ...

21975 Commits (186a89e99c0b75ea038be8159df58f134084436f) All Branches Search

21975 Commits (186a89e99c0b75ea038be8159df58f134084436f)

All Branches