You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Matthew Jordan 6087765a48 rtp_engine: fix crash during remote native bridging when calling get_codecs ... When two RTP channels are in a remote bridge, the remote bridging loop in rtp_engine will periodically check to see if the two channels can still be bridged. One of the many things it checks is whether or not the codecs have changed on the channel. If the codec has changed, it will break out of the loop to re-determine which type of bridge is appropriate. In order to perform this check, the ast_rtp_glue virtual table's get_codec callback is called for each channel. The callback implementations assume that the channel tech private is valid when called; as such, there has always been some code in place to check whether or not the channel pvt is NULL before calling. However, this check is insufficient. The channels are unlocked during the remote bridging loop. It is possible for a channel to get masqueraded between the check for the pvt being NULL and the actual call to get_codec. When this occurs, the callback is called with a ZOMBIE channel, which now has a NULL pvt. Crash. While this has always been possible in Asterisk 1.8, it is much more likely to occur in Asterisk 11 and later versions due to the timing changes that occur when getting the codec from a channel. Note that this is much more likely to be reproduced on slow, boggy hardware running Asterisk 11 - but fairly rarely otherwise. Also Note: This crash was also caught by the various SIP blind transfer tests, in addition to the bug report Alec filed. Review: https://reviewboard.asterisk.org/r/3247/ (closes issue ASTERISK-21737) Reported by: Alec Davis Tested by: Alec Davis ........ Merged revisions 409001 from http://svn.asterisk.org/svn/asterisk/branches/1.8 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@409002 65c4cc65-6c06-0410-ace0-fbb531ad65f3		11 years ago
..
editline	memory leaks: Memory leak cleanup patch by Corey Farrell (first set)	12 years ago
stdtime	Cleanup core main on exit.	13 years ago
Makefile	Remove unneeded linux-gnueabi*	12 years ago
abstract_jb.c	Fix jitter buffer log file creation	12 years ago
acl.c	Trivial patch to make 'best_score' defined for all architectures.	13 years ago
adsi.c	Fix crash in unloading of res_adsi module	13 years ago
alaw.c	Multiple revisions 369001-369002	13 years ago
aoc.c	Cleanup CLI commands on exit for several files.	13 years ago
app.c	memory leaks: Memory leak cleanup patch by Corey Farrell (second set)	12 years ago
ast_expr2.c	Allow the REALTIME() function to report errors back to the caller.	13 years ago
ast_expr2.fl	Avoid cppcheck warnings; removing unused vars and a bit of cleanup.	13 years ago
ast_expr2.h	Allow the REALTIME() function to report errors back to the caller.	13 years ago
ast_expr2.y	Multiple revisions 360356-360357	13 years ago
ast_expr2f.c	Allow the REALTIME() function to report errors back to the caller.	13 years ago
asterisk.c	verbosity: Fix performance of console verbose messages.	12 years ago
asterisk.dynamics	Remove the old stub files, preferring the optional_api method.	15 years ago
asterisk.exports.in	Add _IO_stdin_used in version-script to fix SIGBUSes on Sparc.	12 years ago
astfd.c	Unregister CLI commands on exit	12 years ago
astmm.c	MALLOC_DEBUG: Change fence magic number to be completely different from the freed magic number.	12 years ago
astobj2.c	astobj2: Unregister debug CLI commands at exit	12 years ago
audiohook.c	Multiple revisions 369001-369002	13 years ago
autochan.c	Multiple revisions 369001-369002	13 years ago
autoservice.c	Stopped spamming of debug messages during attended transfer.	12 years ago
bridging.c	Fix bridging thread leak.	13 years ago
buildinfo.c	fix a few small things found by using sparse	17 years ago
callerid.c	Clean up and ensure proper usage of alloca()	13 years ago
ccss.c	Prevent exhaustion of system resources through exploitation of event cache	13 years ago
cdr.c	Check result of ast_var_assign() calls for memory allocation failure.	12 years ago
cel.c	CEL: Protect data structures during reload and shutdown.	12 years ago
channel.c	channel.c: MOH is not working for transferee after attended transfer	11 years ago
channel_internal_api.c	Prevent exhaustion of system resources through exploitation of event cache	13 years ago
chanvars.c	Multiple revisions 369001-369002	13 years ago
cli.c	verbosity: Fix performance of console verbose messages.	12 years ago
config.c	config: Add file size and nanosecond resolution fields to the cached modified config file information.	11 years ago
config_options.c	Ensure global types in the config framework are initialized	12 years ago
cygload.c	Kill off red blobs in most of main/*	13 years ago
data.c	memory leaks: Memory leak cleanup patch by Corey Farrell (second set)	12 years ago
datastore.c	Multiple revisions 369001-369002	13 years ago
db.c	astdb: crash in sqlite3 during shutdown	12 years ago
devicestate.c	devicestate: Make ast_devstate_changed_literal() return value and doxygen consistent.	11 years ago
dial.c	Separate option_types[] from the struct definition.	12 years ago
dns.c	Multiple revisions 369001-369002	13 years ago
dnsmgr.c	Cleanup dnsmgr on exit.	13 years ago
dsp.c	dsp.c User Configurable DTMF_HITS_TO_BEGIN and DTMF_MISSES_TO_END	13 years ago
ecdisa.h	Kill off red blobs in most of main/*	13 years ago
enum.c	Multiple revisions 369001-369002	13 years ago
event.c	Fix incorrect usages of ast_realloc().	12 years ago
features.c	Documentation: doc fixes across various parts of the code for ASTERISK issues 23061,23028,23046,23027	12 years ago
file.c	Protect ast_filestream object when on a channel	12 years ago
fixedjitterbuf.c	Multiple revisions 369001-369002	13 years ago
fixedjitterbuf.h	Kill off red blobs in most of main/*	13 years ago
format.c	format.c: correct possible null pointer dereference	11 years ago
format_cap.c	Multiple revisions 369001-369002	13 years ago
format_pref.c	Address uninitialized conditional that valgrind found	12 years ago
frame.c	Rewrite a comment that didn't adequately explain the code it was documenting.	13 years ago
framehook.c	Multiple revisions 369001-369002	13 years ago
fskmodem.c	Multiple revisions 369001-369002	13 years ago
fskmodem_float.c	Multiple revisions 369001-369002	13 years ago
fskmodem_int.c	Multiple revisions 369001-369002	13 years ago
global_datastores.c	Multiple revisions 369001-369002	13 years ago
hashtab.c	Multiple revisions 369001-369002	13 years ago
heap.c	Fix incorrect usages of ast_realloc().	12 years ago
http.c	Complete http_shutdown.	12 years ago
image.c	Cleanup CLI commands on exit for several files.	13 years ago
indications.c	Fix incorrect usages of ast_realloc().	12 years ago
io.c	Multiple revisions 369001-369002	13 years ago
jitterbuf.c	jitterbuf: Fix memory leak on jitter buffer reset	12 years ago
libasteriskssl.c	Resolve memory leaks in TLS initialization and TLS client connections	13 years ago
libasteriskssl.exports.in	Address OpenSSL initialization issues when using third-party libraries.	14 years ago
loader.c	core/loader: Don't call dlclose in a while loop	12 years ago
lock.c	Fix DEBUG_THREADS when lock is acquired in __constructor__	12 years ago
logger.c	Logger: Fix handling of absolute paths	11 years ago
manager.c	Make a NOTICE about an invalid channel name more useful.	11 years ago
md5.c	md5: supress some compiler warnings.	13 years ago
message.c	Fix lock errors on startup.	12 years ago
named_acl.c	Fix various memory leaks	12 years ago
netsock.c	Multiple revisions 369001-369002	13 years ago
netsock2.c	Fix NULL pointer segfault in ast_sockaddr_parse()	13 years ago
pbx.c	Remove extra defines of AST_PBX_MAX_STACK.	11 years ago
plc.c	Multiple revisions 369001-369002	13 years ago
poll.c	Merged revisions 285268 via svnmerge from	15 years ago
presencestate.c	Fix crash in PresenceState AMI action when specifying an invalid provider	12 years ago
privacy.c	Multiple revisions 369001-369002	13 years ago
rtp_engine.c	rtp_engine: fix crash during remote native bridging when calling get_codecs	11 years ago
say.c	say.c: correct time for polish	12 years ago
sched.c	Multiple revisions 369001-369002	13 years ago
security_events.c	Fix security events for AMI invalid password	12 years ago
sha1.c	Kill off red blobs in most of main/*	13 years ago
sip_api.c	Don't make chan_sip export global symbols.	13 years ago
slinfactory.c	Fix a memory copying bug in slinfactory which was causing mixmonitor issues.	12 years ago
srv.c	Multiple revisions 369001-369002	13 years ago
strcompat.c	Add builtin roundf() for systems lacking it.	13 years ago
strings.c	Multiple revisions 369001-369002	13 years ago
stun.c	Cleanup CLI commands on exit for several files.	13 years ago
syslog.c	Multiple revisions 369001-369002	13 years ago
taskprocessor.c	Cleanup taskprocessor on exit.	13 years ago
tcptls.c	tcptls.c: Made TLS handle a certificate chain file.	11 years ago
tdd.c	Multiple revisions 369001-369002	13 years ago
term.c	Multiple revisions 369001-369002	13 years ago
test.c	memory leaks: Memory leak cleanup patch by Corey Farrell (first set)	12 years ago
threadstorage.c	Unregister CLI commands on exit	12 years ago
timing.c	Cleanup CLI commands on exit for several files.	13 years ago
translate.c	translate: Move freeing of frame to after it is used.	12 years ago
udptl.c	res_rtp_asterisk & udptl: fix port selection to work with SELinux restrictions	11 years ago
ulaw.c	Multiple revisions 369001-369002	13 years ago
utils.c	utils: Fix memory leaks and missed unregistration of CLI commands on shutdown	12 years ago
xml.c	Multiple revisions 369001-369002	13 years ago
xmldoc.c	Remove some spammy debug messages; improve clarity of others	12 years ago