Skip to content
Snippets Groups Projects
  1. Jul 14, 2015
  2. Jul 13, 2015
  3. Jul 12, 2015
    • Matt Jordan's avatar
      main/sorcery: Don't fail object set creation from JSON if field fails · 458715d0
      Matt Jordan authored
      Some individual fields may fail their conversion due to their default
      values being invalid for their custom handlers. In particular,
      configuration values that depend on others being enabled (and thus have
      an empty default value) are notorious for tripping this routine up. An
      example of this are any of the DTLS options for endpoints. Any of the
      DTLS options will fail to be applied (as DTLS is not enabled), causing
      the entire object set to be aborted.
      
      This patch makes it so that we log a debug message when skipping a
      field, and rumble on anyway.
      
      ASTERISK-25238
      
      Change-Id: I0bea13de79f66bf9f9ae6ece0e94a2dc1c026a76
      458715d0
  4. Jul 11, 2015
  5. Jul 10, 2015
  6. Jul 09, 2015
    • Joshua Colp's avatar
      bridge_native_rtp.c: Don't start native RTP bridging after attended transfer. · 4a25d554
      Joshua Colp authored
      The bridge_native_rtp module adds a frame hook to channels which are in
      a native RTP bridge. This frame hook is used to intercept when a hold
      or unhold frame traverses the bridge so native RTP can be stopped or
      started as appropriate. This is expected but exposes a specific bug
      when attended transfers are involved.
      
      Upon completion of an attended transfer an unhold frame is queued up
      to take one of the channels involved off hold. After this is done
      the channel is moved between bridges.
      
      When the frame hook is involved in this case for the unhold it
      releases the channel lock and acquires the bridge lock. This
      allows the bridge core to step in and move the channel
      (potentially changing the bridging techology) from another thread.
      Once completed the bridge lock is released by the bridge core.
      The frame hook is then able to acquire the bridge lock and
      wrongfully starts native RTP again, despite the channel no longer
      being in the bridge or needing to start native RTP. In fact at
      this point the frame hook is no longer attached to the channel.
      
      This change makes it so the native RTP bridge data is available to
      the frame hook when it is invoked. Whether the frame hook has
      been detached or not is stored on the native RTP bridge data and
      is checked by the frame hook before starting or stopping native
      RTP bridging. If the frame hook has been detached it does nothing.
      
      ASTERISK-25240 #close
      
      Change-Id: I13a73186a05f4e5a764f81e5cd0ccec1ed1891d2
      4a25d554
  7. Jul 08, 2015
  8. Jul 07, 2015
  9. Jul 06, 2015
    • Richard Mudgett's avatar
      res_pjsip_mwi.c: Fix MWI subscription memory corruption crash. · 189841dd
      Richard Mudgett authored
      MWI subscriptions can crash or corrupt memory when using the subscription
      datastore to access the MWI subscription object because the datastore is
      not holding a reference to the object.
      
      * Give the subscription datastore a ref to the MWI subscription object.
      It is unfortunate that the ref causes a circular ref chain that must be
      explicitly broken to allow the memory to get released.  The loop is broken
      when the subscription is shutdown and if the subscription setup fails.
      
      ASTERISK-25168 #close
      Reported by: Carl Fortin
      
      Change-Id: Ice4fa823f138ff10a6c74d280699c41a82836d4f
      189841dd
    • Richard Mudgett's avatar
      PJSIP XML, XPIDF: Fix buffer size overwrite memory corruption error. · 7cd99be5
      Richard Mudgett authored
      When res_pjsip body generator modules were generating XML or XPIDF
      response bodies, there was a chance that the generated body would be the
      exact size of the supplied buffer.  Adding the nul string terminator would
      then write beyond the end of the buffer and potentially corrupt memory.
      
      * Fix MALLOC_DEBUG high fence violations caused by adding a nul string
      terminator on the end of a buffer for XML or XPIDF response bodies.
      
      * Made calls to pj_xml_print() safer if the XML prolog is requested.  Due
      to a bug in pjproject, the return value could be -1 _or_
      AST_PJSIP_XML_PROLOG_LEN if the supplied buffer is not large enough.
      
      * Updated the doxygen comment of AST_PJSIP_XML_PROLOG_LEN to describe the
      return value of pj_xml_print() when the supplied buffer is not large
      enough.
      
      ASTERISK-25168
      Reported by: Carl Fortin
      
      Change-Id: Id70e1d373a6a2b2bd9e678b5cbc5e55b308981de
      7cd99be5
    • Richard Mudgett's avatar
      PJSIP FAX: Fix T.38 automatic reject timer NULL channel pointer dereferences. · 792ed7ce
      Richard Mudgett authored
      When a caller calls a FAX number and then hangs up right after the call is
      answered then the T.38 re-INVITE automatic reject timer may still be
      running after the channel goes away.
      
      * Added session NULL channel checks on the code paths that get executed by
      t38_automatic_reject() to prevent a crash when the T.38 re-INVITE
      automatic reject timer expires.
      
      ASTERISK-25168
      Reported by: Carl Fortin
      
      Change-Id: I07b6cd23815aedce5044f8f32543779e2f7a2403
      792ed7ce
Loading