Merged revisions 320796 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.8

........
  r320796 | rmudgett | 2011-05-25 11:23:11 -0500 (Wed, 25 May 2011) | 17 lines
  
  Give zombies a safe channel driver to use.
  
  Recent crashes from zombie channels suggests that they need a safe home to
  goto.  When a masquerade happens, the physical part of the zombie channel
  is hungup.  The hangup normally sets the channel private pointer to NULL.
  If someone then blindly does a callback to the channel driver, a crash is
  likely because the private pointer is NULL.
  
  The masquerade now sets the channel technology of zombie channels to the
  kill channel driver.
  
  Related to the following issues:
  (issue #19116)
  (issue #19310)
  
  Review: https://reviewboard.asterisk.org/r/1224/
........


git-svn-id: http://svn.digium.com/svn/asterisk/trunk@320820 f38db490-d61c-443f-a65b-d21fe96a405b

4 files changed, 67 insertions, 49 deletions

diff --git a/include/asterisk/channel.h b/include/asterisk/channel.h
index 46039ac85..c1b99db7d 100644
--- a/include/asterisk/channel.h
+++ b/include/asterisk/channel.h
@@ -633,6 +633,9 @@ struct ast_channel_tech {
 	int (* cc_callback)(struct ast_channel *inbound, const char *dest, ast_cc_callback_fn callback);
 };
 
+/*! Kill the channel channel driver technology descriptor. */
+extern const struct ast_channel_tech ast_kill_tech;
+
 struct ast_epoll_data;
 
 /*!
diff --git a/main/channel.c b/main/channel.c
index c97268c50..103627bc3 100644
--- a/main/channel.c
+++ b/main/channel.c
@@ -612,6 +612,55 @@ static struct ast_cli_entry cli_channel[] = {
 	AST_CLI_DEFINE(handle_cli_core_show_channeltype,  "Give more details on that channel type")
 };
 
+static struct ast_frame *kill_read(struct ast_channel *chan)
+{
+	/* Hangup channel. */
+	return NULL;
+}
+
+static struct ast_frame *kill_exception(struct ast_channel *chan)
+{
+	/* Hangup channel. */
+	return NULL;
+}
+
+static int kill_write(struct ast_channel *chan, struct ast_frame *frame)
+{
+	/* Hangup channel. */
+	return -1;
+}
+
+static int kill_fixup(struct ast_channel *oldchan, struct ast_channel *newchan)
+{
+	/* No problem fixing up the channel. */
+	return 0;
+}
+
+static int kill_hangup(struct ast_channel *chan)
+{
+	chan->tech_pvt = NULL;
+	return 0;
+}
+
+/*!
+ * \brief Kill the channel channel driver technology descriptor.
+ *
+ * \details
+ * The purpose of this channel technology is to encourage the
+ * channel to hangup as quickly as possible.
+ *
+ * \note Used by DTMF atxfer and zombie channels.
+ */
+const struct ast_channel_tech ast_kill_tech = {
+	.type = "Kill",
+	.description = "Kill channel (should not see this)",
+	.read = kill_read,
+	.exception = kill_exception,
+	.write = kill_write,
+	.fixup = kill_fixup,
+	.hangup = kill_hangup,
+};
+
 #ifdef CHANNEL_TRACE
 /*! \brief Destructor for the channel trace datastore */
 static void ast_chan_trace_destroy_cb(void *data)
@@ -6613,6 +6662,12 @@ int ast_do_masquerade(struct ast_channel *original)
 		goto done;
 	}
 
+	/*
+	 * We just hung up the physical side of the channel.  Set the
+	 * new zombie to use the kill channel driver for safety.
+	 */
+	clonechan->tech = &ast_kill_tech;
+
 	/* Mangle the name of the clone channel */
 	snprintf(zombn, sizeof(zombn), "%s<ZOMBIE>", orig); /* quick, hide the brains! */
 	__ast_change_name_nolink(clonechan, zombn);
diff --git a/main/features.c b/main/features.c
index 1bb86fc30..e8e9164d3 100644
--- a/main/features.c
+++ b/main/features.c
@@ -478,58 +478,15 @@ struct ast_dial_features {
 };
 
 #if defined(ATXFER_NULL_TECH)
-static struct ast_frame *null_read(struct ast_channel *chan)
-{
-	/* Hangup channel. */
-	return NULL;
-}
-
-static struct ast_frame *null_exception(struct ast_channel *chan)
-{
-	/* Hangup channel. */
-	return NULL;
-}
-
-static int null_write(struct ast_channel *chan, struct ast_frame *frame)
-{
-	/* Hangup channel. */
-	return -1;
-}
-
-static int null_fixup(struct ast_channel *oldchan, struct ast_channel *newchan)
-{
-	/* No problem fixing up the channel. */
-	return 0;
-}
-
-static int null_hangup(struct ast_channel *chan)
-{
-	chan->tech_pvt = NULL;
-	return 0;
-}
-
-static const struct ast_channel_tech null_tech = {
-	.type = "NULL",
-	.description = "NULL channel driver for atxfer",
-	.capabilities = -1,
-	.read = null_read,
-	.exception = null_exception,
-	.write = null_write,
-	.fixup = null_fixup,
-	.hangup = null_hangup,
-};
-#endif	/* defined(ATXFER_NULL_TECH) */
-
-#if defined(ATXFER_NULL_TECH)
 /*!
  * \internal
- * \brief Set the channel technology to the NULL technology.
+ * \brief Set the channel technology to the kill technology.
  *
  * \param chan Channel to change technology.
  *
  * \return Nothing
  */
-static void set_null_chan_tech(struct ast_channel *chan)
+static void set_kill_chan_tech(struct ast_channel *chan)
 {
 	int idx;
 
@@ -546,8 +503,8 @@ static void set_null_chan_tech(struct ast_channel *chan)
 		chan->tech_pvt = NULL;
 	}
 
-	/* Install the NULL technology and wake up anyone waiting on it. */
-	chan->tech = &null_tech;
+	/* Install the kill technology and wake up anyone waiting on it. */
+	chan->tech = &ast_kill_tech;
 	for (idx = 0; idx < AST_MAX_FDS; ++idx) {
 		switch (idx) {
 		case AST_ALERT_FD:
@@ -3146,7 +3103,7 @@ static struct ast_channel *feature_request_and_dial(struct ast_channel *caller,
 				 * Get rid of caller's physical technology so it is free for
 				 * other calls.
 				 */
-				set_null_chan_tech(caller);
+				set_kill_chan_tech(caller);
 #endif	/* defined(ATXFER_NULL_TECH) */
 			} else {
 				/* caller is not hungup so monitor it. */
diff --git a/main/format_cap.c b/main/format_cap.c
index 3ef0e74d3..63dc0491d 100644
--- a/main/format_cap.c
+++ b/main/format_cap.c
@@ -307,8 +307,11 @@ int ast_format_cap_iscompatible(const struct ast_format_cap *cap, const struct a
 {
 	struct ast_format *f;
 	struct ast_format_cap *tmp_cap = (struct ast_format_cap *) cap;
-	f = ao2_find(tmp_cap->formats, (struct ast_format *) format, OBJ_POINTER | tmp_cap->nolock);
 
+	if (!tmp_cap) {
+		return 0;
+	}
+	f = ao2_find(tmp_cap->formats, (struct ast_format *) format, OBJ_POINTER | tmp_cap->nolock);
 	if (f) {
 		ao2_ref(f, -1);
 		return 1;