chan_sip: Check sip_pvt pointer in ast_channel_get_t38_state(c)
authorFilip Jenicek <phill@janevim.cz>
Tue, 8 Dec 2015 07:57:22 +0000 (08:57 +0100)
committerRichard Mudgett <rmudgett@digium.com>
Tue, 8 Dec 2015 18:23:30 +0000 (12:23 -0600)
Asterisk may crash when calling ast_channel_get_t38_state(c)
on a locked channel which is being hung up.

ASTERISK-25609 #close

Change-Id: Ifaa707c04b865a290ffab719bd2e5c48ff667c7b

channels/chan_sip.c

index b2d6112..cd03e15 100644 (file)
@@ -4757,6 +4757,11 @@ static int sip_queryoption(struct ast_channel *chan, int option, void *data, int
        struct sip_pvt *p = (struct sip_pvt *) ast_channel_tech_pvt(chan);
        char *cp;
 
+       if (!p) {
+               ast_debug(1, "Attempt to Ref a null pointer. Sip private structure is gone!\n");
+               return -1;
+       }
+
        sip_pvt_lock(p);
 
        switch (option) {