Convert all release tags to Opsound music-on-hold.

For more details:
http://blogs.digium.com/2009/08/18/asterisk-music-on-hold-changes/



git-svn-id: https://origsvn.digium.com/svn/asterisk/tags/1.0.11@212958 65c4cc65-6c06-0410-ace0-fbb531ad65f3

.version

@@ -0,0 +1 @@
+1.0.11

ChangeLog

@@ -3,6 +3,12 @@
        not listed here.  A complete listing of changes is available through
        the Asterisk-CVS mailing list hosted at http://lists.digium.com.
 
+Asterisk 1.0.11
+
+ -- chan_iax2
+    -- A security vulnerability that could lead to denial of service attacks
+       and Asterisk process crashes was fixed in this release.
+	
 Asterisk 1.0.10
 
  -- chan_local
@@ -40,10 +46,6 @@ Asterisk 1.0.10
  -- extensions
     -- A potential crash has been fixed when calling LEN() to get the length of
        a string that was 80 characters or larger.
- -- logger
-    -- The Asterisk logger will automatically detect when a log file needs to
-       be rotated.  However, this feature could put Asterisk in a nasty loop
-       that would result in a crash.
  -- general
     -- Added man pages for astgenkey, autosupport, and safe_asterisk
 

apps/app_forkcdr.c

@@ -37,6 +37,7 @@ LOCAL_USER_DECL;
 static void ast_cdr_clone(struct ast_cdr *cdr) {
 	struct ast_cdr *newcdr = ast_cdr_alloc();
 	memcpy(newcdr,cdr,sizeof(struct ast_cdr));
+	newcdr->next = NULL;
 	ast_cdr_append(cdr,newcdr);
 	gettimeofday(&newcdr->start, NULL);
 	memset(&newcdr->answer, 0, sizeof(newcdr->answer));

channels/chan_iax2.c

@@ -5052,11 +5052,11 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr));
 		return 1;
 	}
-	if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) {
+	if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) {
 		/* This is a video frame, get call number */
 		fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1);
 		minivid = 1;
-	} else if (meta->zeros == 0) {
+	} else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) {
 		/* This is a meta header */
 		switch(meta->metacmd) {
 		case IAX_META_TRUNK:
@@ -5149,11 +5149,19 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 		}
 		return 1;
 	}
+	/* if we got here and ->zeros contains zeros, this cannot be a valid
+	   miniframe or full frame but it wasn't a valid video frame or meta
+	   frame either, so we reject it
+	*/
+	if (vh->zeros == 0) {
+		ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port));
+		return 1;
+	}
 #ifdef DEBUG_SUPPORT
 	if (iaxdebug)
 		iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr));
 #endif
-	if (ntohs(mh->callno) & IAX_FLAG_FULL) {
+	if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) {
 		/* Get the destination call number */
 		dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
 		/* Retrieve the type and subclass */

pbx/pbx_spool.c

@@ -271,9 +271,11 @@ static int scan_service(char *fn, time_t now, time_t atime)
 #endif
 				fclose(f);
 				if (o->retries <= o->maxretries) {
+					now += o->retrytime;
 					if (o->callingpid && (o->callingpid == ast_mainpid)) {
 						safe_append(o, time(NULL), "DelayedRetry");
 						ast_log(LOG_DEBUG, "Delaying retry since we're currently running '%s'\n", o->fn);
+						free(o);
 					} else {
 						/* Increment retries */
 						o->retries++;
@@ -285,7 +287,6 @@ static int scan_service(char *fn, time_t now, time_t atime)
 						safe_append(o, now, "StartRetry");
 						launch_service(o);
 					}
-					now += o->retrytime;
 					return now;
 				} else {
 					ast_log(LOG_EVENT, "Queued call to %s/%s expired without completion after %d attempt(s)\n", o->tech, o->dest, o->retries - 1);

res/res_agi.c

@@ -1649,9 +1649,8 @@ static int agi_exec_full(struct ast_channel *chan, void *data, int enhanced, int
 	strncpy(buf, data, sizeof(buf) - 1);
 
 	memset(&agi, 0, sizeof(agi));
-        while ((stringp = strsep(&tmp, "|"))) {
+        while ((stringp = strsep(&tmp, "|")) && argc < MAX_ARGS - 1)
 		argv[argc++] = stringp;
-        }
 	argv[argc] = NULL;
 
 	LOCAL_USER_ADD(u);