Fix segfault in chan_dahdi for CHANNEL(dahdi_span) evaluation on hangup.

* Added NULL private pointer checks in the following chan_dahdi channel
callbacks: dahdi_func_read(), dahdi_func_write(), dahdi_setoption(), and
dahdi_queryoption().

(closes issue ASTERISK-19142)
Reported by: Diego Aguirre
Tested by: rmudgett
........

Merged revisions 349558 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 349559 from http://svn.asterisk.org/svn/asterisk/branches/10

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@349560 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index f0ae826..ce5b28b 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -6655,7 +6655,7 @@ static int dahdi_queryoption(struct ast_channel *chan, int option, void *data, i
        struct dahdi_pvt *p = chan->tech_pvt;
 
        /* all supported options require data */
-       if (!data || (*datalen < 1)) {
+       if (!p || !data || (*datalen < 1)) {
                errno = EINVAL;
                return -1;
        }
@@ -6701,7 +6701,7 @@ static int dahdi_setoption(struct ast_channel *chan, int option, void *data, int
 
 
        /* all supported options require data */
-       if (!data || (datalen < 1)) {
+       if (!p || !data || (datalen < 1)) {
                errno = EINVAL;
                return -1;
        }
@@ -6914,6 +6914,12 @@ static int dahdi_func_read(struct ast_channel *chan, const char *function, char
        struct dahdi_pvt *p = chan->tech_pvt;
        int res = 0;
 
+       if (!p) {
+               /* No private structure! */
+               *buf = '\0';
+               return -1;
+       }
+
        if (!strcasecmp(data, "rxgain")) {
                ast_mutex_lock(&p->lock);
                snprintf(buf, len, "%f", p->rxgain);
@@ -7047,6 +7053,11 @@ static int dahdi_func_write(struct ast_channel *chan, const char *function, char
        struct dahdi_pvt *p = chan->tech_pvt;
        int res = 0;
 
+       if (!p) {
+               /* No private structure! */
+               return -1;
+       }
+
        if (!strcasecmp(data, "buffers")) {
                int num_bufs, policy;