From 9f7ce9da4104118efaafd07c141e8e3c3e63fb9d Mon Sep 17 00:00:00 2001
From: Mark Michelson <mmichelson@digium.com>
Date: Mon, 22 Dec 2008 16:07:59 +0000
Subject: [PATCH] Fix a file playback crash and explicitly initialize values in
 func_timeout.c

A crash was brought up on the bugtracker. The first run through valgrind
was full of legitimate complaints of uninitialized values in func_timeout when
setting a response timeout. These were fixed but the crash persisted.

A second run through showed the real problem. The reference counting used
for filestreams was incorrect because there were some missing increments
when a frame was read from a format module.

(closes issue #14118)
Reported by: blitzrage
Patches:
      14118v2.patch uploaded by putnopvut (license 60)
Tested by: blitzrage



git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@166267 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 funcs/func_timeout.c | 15 ++++++++++-----
 main/file.c          |  8 ++++++++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/funcs/func_timeout.c b/funcs/func_timeout.c
index a035a05634..2b3a000b44 100644
--- a/funcs/func_timeout.c
+++ b/funcs/func_timeout.c
@@ -119,11 +119,12 @@ static int timeout_read(struct ast_channel *chan, const char *cmd, char *data,
 static int timeout_write(struct ast_channel *chan, const char *cmd, char *data,
 			 const char *value)
 {
-	double x;
-	long sec;
+	double x = 0.0;
+	long sec = 0L;
 	char timestr[64];
 	struct ast_tm myt;
-	struct timeval when;
+	struct timeval when = {0,};
+	int res;
 
 	if (!chan)
 		return -1;
@@ -136,9 +137,13 @@ static int timeout_write(struct ast_channel *chan, const char *cmd, char *data,
 	if (!value)
 		return -1;
 
-	if ((sscanf(value, "%ld%lf", &sec, &x) == 0) || sec < 0)
+	res = sscanf(value, "%ld%lf", &sec, &x);
+	if (res == 0 || sec < 0) {
 		when.tv_sec = 0;
-	else {
+		when.tv_usec = 0;
+	} else if (res == 1) {
+		when.tv_sec = sec;
+	} else if (res == 2) {
 		when.tv_sec = sec;
 		when.tv_usec = x * 1000000;
 	}
diff --git a/main/file.c b/main/file.c
index 5e920cc3b4..aee9646491 100644
--- a/main/file.c
+++ b/main/file.c
@@ -714,6 +714,10 @@ static enum fsread_res ast_readaudio_callback(struct ast_filestream *s)
 			goto return_failure;
 		
 		fr = s->fmt->read(s, &whennext);
+		if (fr) {
+			ast_set_flag(fr, AST_FRFLAG_FROM_FILESTREAM);
+			ao2_ref(s, +1);
+		}
 		if (!fr /* stream complete */ || ast_write(s->owner, fr) /* error writing */) {
 			if (fr)
 				ast_log(LOG_WARNING, "Failed to write frame\n");
@@ -764,6 +768,10 @@ static enum fsread_res ast_readvideo_callback(struct ast_filestream *s)
 
 	while (!whennext) {
 		struct ast_frame *fr = s->fmt->read(s, &whennext);
+		if (fr) {
+			ast_set_flag(fr, AST_FRFLAG_FROM_FILESTREAM);
+			ao2_ref(s, +1);
+		}
 		if (!fr || ast_write(s->owner, fr)) { /* no stream or error, as above */
 			if (fr)
 				ast_log(LOG_WARNING, "Failed to write frame\n");
-- 
GitLab