Fix segfault-prone code paths across core and apps

- AmArg::pop_back: replace undefined erase(end()) with pop_back()
- trans_table: replace assert-only dynamic_cast guards with runtime
  NULL checks and error returns (asserts compiled out in release)
- SBC: add args.size() bounds checks before accessing AmArg elements
  in postControlCmd, reloadProfile, loadProfile, setActiveProfile,
  setRegexMap, loadCallcontrolModules
- sems.cpp: rewrite signal handler to only set sig_atomic_t flags;
  move unsafe work (mutex, event broadcast) to process_pending_signals()
  called from the SIP event loop
- AmConferenceChannel: remove dangerous delete-this in on_flushed()
  callback; object lifetime is managed by owning AmConferenceChannel
- ip_util: fix uninitialized str[0] read in am_inet_ntop_sip IPv6 path;
  set '[' before inet_ntop and add buffer overflow guards
- AmSmtpClient: check socket() return before connect()
- AmEventDispatcher::broadcast: collect queue pointers under lock then
  post events outside lock to prevent iterator invalidation
- DSMChartReader::importModule: add missing dlclose() on error paths
- AmUtils/arg_conversion: sprintf -> snprintf to prevent buffer overflows
- log.cpp: check malloc return in __lds before using funcname pointer
- tcp_trsp: guard memmove against integer underflow when addr_shift
  exceeds input_len
- RpcPeer: check socket() return before fcntl/connect

Author: Marcel Hecko

apps/dsm/DSMChartReader.cpp

@@ -243,13 +243,15 @@ bool DSMChartReader::importModule(const string& mod_cmd, const string& mod_path)
   SCFactoryCreate fc = NULL;
   if ((fc = (SCFactoryCreate)dlsym(h_dl,SC_FACTORY_EXPORT_STR)) == NULL) {
     ERROR("invalid SC module '%s' (SC_EXPORT missing?)\n", fname.c_str());
+    dlclose(h_dl);
     return false;
   }
-   
+
   DSMModule* mod = (DSMModule*)fc();
   if (!mod) {
-    ERROR("module '%s' did not return functions.\n", 
+    ERROR("module '%s' did not return functions.\n",
 	  fname.c_str());
+    dlclose(h_dl);
     return false;
   }
   mods.push_back(mod);

apps/jsonrpc/RpcPeer.cpp

@@ -94,6 +94,10 @@ int JsonrpcNetstringsConnection::connect(const string& host, int port,
   // }
 
   fd = socket(PF_INET, SOCK_STREAM, 0);
+  if(fd < 0) {
+    res_str = "socket() failed: " + string(strerror(errno));
+    return 300;
+  }
   sa.sin_port = htons(port);
   sa.sin_family = PF_INET;
 

apps/sbc/SBC.cpp

@@ -542,6 +542,11 @@ void SBCFactory::reloadProfiles(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::reloadProfile(const AmArg& args, AmArg& ret) {
+  if (!args.size()) {
+    ret.push(400);
+    ret.push("Parameters error: missing arguments");
+    return;
+  }
   bool failed = false;
   string res = "OK";
   AmArg p;
@@ -583,7 +588,7 @@ void SBCFactory::reloadProfile(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::loadProfile(const AmArg& args, AmArg& ret) {
-  if (!args[0].hasMember("name") || !args[0].hasMember("path")) {
+  if (!args.size() || !args[0].hasMember("name") || !args[0].hasMember("path")) {
     ret.push(400);
     ret.push("Parameters error: expected ['name': profile_name] "
 	     "and ['path': profile_path]");
@@ -623,7 +628,7 @@ void SBCFactory::getActiveProfile(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::setActiveProfile(const AmArg& args, AmArg& ret) {
-  if (!args[0].hasMember("active_profile")) {
+  if (!args.size() || !args[0].hasMember("active_profile")) {
     ret.push(400);
     ret.push("Parameters error: expected ['active_profile': <active_profile list>] ");
     return;
@@ -651,7 +656,7 @@ void SBCFactory::getRegexMapNames(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::setRegexMap(const AmArg& args, AmArg& ret) {
-  if (!args[0].hasMember("name") || !args[0].hasMember("file") ||
+  if (!args.size() || !args[0].hasMember("name") || !args[0].hasMember("file") ||
       !isArgCStr(args[0]["name"]) || !isArgCStr(args[0]["file"])) {
     ret.push(400);
     ret.push("Parameters error: expected ['name': <name>, 'file': <file name>]");
@@ -673,6 +678,11 @@ void SBCFactory::setRegexMap(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::loadCallcontrolModules(const AmArg& args, AmArg& ret) {
+  if (!args.size()) {
+    ret.push(400);
+    ret.push("Parameters error: missing arguments");
+    return;
+  }
   string load_cc_plugins = args[0].asCStr();
   if (!load_cc_plugins.empty()) {
     INFO("loading call control plugins '%s' from '%s'\n",
@@ -691,6 +701,11 @@ void SBCFactory::loadCallcontrolModules(const AmArg& args, AmArg& ret) {
 }
 
 void SBCFactory::postControlCmd(const AmArg& args, AmArg& ret) {
+  if (args.size()<2) {
+    ret.push(400);
+    ret.push("Parameters error: expected at least cmd and ltag");
+    return;
+  }
   SBCControlEvent* evt;
   if (args.size()<3) {
     evt = new SBCControlEvent(args[1].asCStr());

apps/sbc/arg_conversion.cpp

@@ -17,23 +17,23 @@ static string arg2string(const AmArg &a)
   switch (a.getType()) {
     case AmArg::CStr:
       p = a.asCStr();
-      sprintf(tmp, "%c%zd/", CSTR_LABEL, strlen(p));
+      snprintf(tmp, sizeof(tmp), "%c%zd/", CSTR_LABEL, strlen(p));
       s = tmp;
       s += p;
       return s;
 
     case AmArg::Array:
-      sprintf(tmp, "%c%zd/", ARRAY_LABEL, a.size());
+      snprintf(tmp, sizeof(tmp), "%c%zd/", ARRAY_LABEL, a.size());
       s = tmp;
       for (size_t i = 0; i < a.size(); i ++) s += arg2string(a[i]);
       return s;
 
     case AmArg::Struct:
-      sprintf(tmp, "%c%zd/", STRUCT_LABEL, a.size());
+      snprintf(tmp, sizeof(tmp), "%c%zd/", STRUCT_LABEL, a.size());
       s = tmp;
       for (AmArg::ValueStruct::const_iterator it = a.asStruct()->begin();
            it != a.asStruct()->end(); ++it) {
-        sprintf(tmp, "%zd/", it->first.size());
+        snprintf(tmp, sizeof(tmp), "%zd/", it->first.size());
         s += tmp;
         s += it->first;
         s += arg2string(it->second);

apps/voicemail/AmSmtpClient.cpp

@@ -95,8 +95,13 @@ bool AmSmtpClient::connect(const string& _server_ip, unsigned short _server_port
   }
 
   sd = socket(PF_INET, SOCK_STREAM, 0);
+  if(sd < 0) {
+    ERROR("socket() failed: %s\n",strerror(errno));
+    return false;
+  }
   if(::connect(sd,(struct sockaddr *)&addr,sizeof(addr)) == -1) {
     ERROR("%s\n",strerror(errno));
+    close();
     return false;
   }
 

core/AmArg.cpp

@@ -202,7 +202,7 @@ void AmArg::pop_back(AmArg &a) {
     return;
   }
   a = v_array->back();
-  v_array->erase(v_array->end());
+  v_array->pop_back();
 }
 
 void AmArg::pop_back() {

core/AmConferenceChannel.cpp

@@ -121,6 +121,8 @@ int ChannelWritingFile::write_to_file(const void* buf, unsigned int len) {
 }
 
 void ChannelWritingFile::on_flushed() {
-  DBG("file on_flushed, deleting self\n");
-  delete this; // uh!
+  DBG("file on_flushed\n");
+  // Note: this object is owned by AmConferenceChannel and will be
+  // cleaned up when the channel is destroyed. Do not delete here
+  // as the parent still holds a raw pointer to us.
 }

core/AmEventDispatcher.cpp

@@ -204,16 +204,18 @@ bool AmEventDispatcher::broadcast(AmEvent* ev)
     for (size_t i=0;i<EVENT_DISPATCHER_BUCKETS;i++) {
       queues_mut[i].lock();
 
-      EvQueueMapIter it = queues[i].begin(); 
-      while (it != queues[i].end()) {
-	EvQueueMapIter this_evq = it;
-	it++;
-	queues_mut[i].unlock();
-	this_evq->second.q->postEvent(ev->clone());
-	queues_mut[i].lock();
-	posted = true;
+      std::vector<AmEventQueueInterface*> bucket_queues;
+      for (EvQueueMapIter it = queues[i].begin();
+	   it != queues[i].end(); ++it) {
+	bucket_queues.push_back(it->second.q);
       }
+
       queues_mut[i].unlock();
+
+      for (size_t j=0;j<bucket_queues.size();j++) {
+	bucket_queues[j]->postEvent(ev->clone());
+	posted = true;
+      }
     }
 
     delete ev;

core/AmUtils.cpp

@@ -164,7 +164,7 @@ string long2hex(unsigned long val)
 /** Convert a double to a string. (from jsoncpp) */
 string double2str(double val) {
   char buffer[32];
-  sprintf(buffer, "%#.16g", val); 
+  snprintf(buffer, sizeof(buffer), "%#.16g", val);
   char* ch = buffer + strlen(buffer) - 1;
   if (*ch != '0') return buffer; // nothing to truncate, so save time
   while(ch > buffer && *ch == '0'){
@@ -523,8 +523,8 @@ std::string URL_encode(const std::string &s)
         else
         {
             escaped.append("%");
-            char buf[3];
-            sprintf(buf, "%.2X", (unsigned char)s[i]);
+            char buf[4];
+            snprintf(buf, sizeof(buf), "%.2X", (unsigned char)s[i]);
             escaped.append(buf);
         }
     }

core/SipCtrlInterface.cpp

@@ -28,6 +28,7 @@
  */
 #include "SipCtrlInterface.h"
 
+#include "sems.h"
 #include "AmUtils.h"
 #include "AmSipMsg.h"
 #include "AmMimeBody.h"
@@ -400,7 +401,8 @@ int _SipCtrlInterface::run()
     }
 
     while (!stopped.get()) {
-        stopped.wait_for();
+        stopped.wait_for_to(500); // wake periodically to process signals
+	process_pending_signals();
     }
 
     DBG("SIP control interface ending\n");