ftmod_libpri: Fix NULL pointer deref in on_hangup()

Harald Welte · Harald Welte · commit a341d58fbdf6 · 2019-12-29T00:26:14.000+01:00
diff --git a/libs/freetdm/src/ftmod/ftmod_libpri/ftmod_libpri.c b/libs/freetdm/src/ftmod/ftmod_libpri/ftmod_libpri.c
@@ -1405,12 +1405,13 @@ static int on_hangup(lpwrap_pri_t *spri, lpwrap_pri_event_t event_type, pri_even
 {
 	ftdm_span_t *span = spri->span;
 	ftdm_channel_t *chan = ftdm_span_get_channel(span, pevent->hangup.channel);
-	ftdm_libpri_b_chan_t *chan_priv = chan->call_data;
+	ftdm_libpri_b_chan_t *chan_priv;
 
 	if (!chan) {
 		ftdm_log(FTDM_LOG_CRIT, "-- Hangup on channel %d:%d but it's not in use?\n", ftdm_span_get_id(spri->span), pevent->hangup.channel);
 		return 0;
 	}
+	chan_priv = chan->call_data;
 
 	ftdm_channel_lock(chan);
 

Original file line number	Diff line number	Diff line change
`@@ -1405,12 +1405,13 @@ static int on_hangup(lpwrap_pri_t *spri, lpwrap_pri_event_t event_type, pri_even`
`1405`	`1405`	`{`
`1406`	`1406`	`ftdm_span_t *span = spri->span;`
`1407`	`1407`	`ftdm_channel_t *chan = ftdm_span_get_channel(span, pevent->hangup.channel);`
`1408`		`- ftdm_libpri_b_chan_t *chan_priv = chan->call_data;`
	`1408`	`+ ftdm_libpri_b_chan_t *chan_priv;`
`1409`	`1409`
`1410`	`1410`	`if (!chan) {`
`1411`	`1411`	`ftdm_log(FTDM_LOG_CRIT, "-- Hangup on channel %d:%d but it's not in use?\n", ftdm_span_get_id(spri->span), pevent->hangup.channel);`
`1412`	`1412`	`return 0;`
`1413`	`1413`	`}`
	`1414`	`+ chan_priv = chan->call_data;`
`1414`	`1415`
`1415`	`1416`	`ftdm_channel_lock(chan);`
`1416`	`1417`