[asterisk-commits] russell: branch 1.4 r67716 - in /branches/1.4: ./ include/asterisk/ main/

[asterisk-commits at lists.digium.com]

Author: russell
Date: Wed Jun  6 11:55:59 2007
New Revision: 67716

URL: http://svn.digium.com/view/asterisk?view=rev&rev=67716
Log:
Merged revisions 67715 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.2

........
r67715 | russell | 2007-06-06 11:40:51 -0500 (Wed, 06 Jun 2007) | 5 lines

We have some bug reports showing crashes due to a double free of a channel.
Add a sanity check to ast_channel_free() to make sure we don't go on trying
to free a channel that wasn't found in the channel list.
(issue #8850, and others...)

........

Modified:
    branches/1.4/   (props changed)
    branches/1.4/include/asterisk/linkedlists.h
    branches/1.4/main/channel.c

Propchange: branches/1.4/
------------------------------------------------------------------------------
Binary property 'branch-1.2-merged' - no diff available.

Modified: branches/1.4/include/asterisk/linkedlists.h
URL: http://svn.digium.com/view/asterisk/branches/1.4/include/asterisk/linkedlists.h?view=diff&rev=67716&r1=67715&r2=67716
==============================================================================
--- branches/1.4/include/asterisk/linkedlists.h (original)
+++ branches/1.4/include/asterisk/linkedlists.h Wed Jun  6 11:55:59 2007
@@ -729,8 +729,10 @@
   used to link entries of this list together.
   \warning The removed entry is \b not freed nor modified in any way.
  */
-#define AST_LIST_REMOVE(head, elm, field) do {			        \
+#define AST_LIST_REMOVE(head, elm, field) ({			        \
+	__typeof(elm) __res = NULL; \
 	if ((head)->first == (elm)) {					\
+		__res = (head)->first;                      \
 		(head)->first = (elm)->field.next;			\
 		if ((head)->last == (elm))			\
 			(head)->last = NULL;			\
@@ -739,13 +741,15 @@
 		while (curelm && (curelm->field.next != (elm)))			\
 			curelm = curelm->field.next;			\
 		if (curelm) { \
+			__res = curelm; \
 			curelm->field.next = (elm)->field.next;			\
 			if ((head)->last == (elm))				\
 				(head)->last = curelm;				\
 		} \
 	}								\
-        (elm)->field.next = NULL;                                       \
-} while (0)
+	(elm)->field.next = NULL;                                       \
+	(__res); \
+})
 
 #define AST_RWLIST_REMOVE AST_LIST_REMOVE
 

Modified: branches/1.4/main/channel.c
URL: http://svn.digium.com/view/asterisk/branches/1.4/main/channel.c?view=diff&rev=67716&r1=67715&r2=67716
==============================================================================
--- branches/1.4/main/channel.c (original)
+++ branches/1.4/main/channel.c Wed Jun  6 11:55:59 2007
@@ -1176,7 +1176,10 @@
 	headp=&chan->varshead;
 	
 	AST_LIST_LOCK(&channels);
-	AST_LIST_REMOVE(&channels, chan, chan_list);
+	if (!AST_LIST_REMOVE(&channels, chan, chan_list)) {
+		AST_LIST_UNLOCK(&channels);
+		ast_log(LOG_ERROR, "Unable to find channel in list to free. Assuming it has already been done.\n");
+	}
 	/* Lock and unlock the channel just to be sure nobody
 	   has it locked still */
 	ast_channel_lock(chan);