[asterisk-commits] marta: branch marta/astobj2 r82061 - /team/marta/astobj2/main/astobj2.c

[SVN commits to the Asterisk project]

Author: marta
Date: Sun Sep  9 17:12:11 2007
New Revision: 82061

URL: http://svn.digium.com/view/asterisk?view=rev&rev=82061
Log:
Fix a possible race condition in ao2_iterator_next().
A pointer to a bucket_list element was used with the container unlocked,
making it possible for a concurrent ao2_unlink() to free it. 

Tnx to Fabio Checconi for pointing this out.

Modified:
    team/marta/astobj2/main/astobj2.c

Modified: team/marta/astobj2/main/astobj2.c
URL: http://svn.digium.com/view/asterisk/team/marta/astobj2/main/astobj2.c?view=diff&rev=82061&r1=82060&r2=82061
==============================================================================
--- team/marta/astobj2/main/astobj2.c (original)
+++ team/marta/astobj2/main/astobj2.c Sun Sep  9 17:12:11 2007
@@ -501,6 +501,7 @@
 {
 	int lim;
 	struct bucket_list *p = NULL;
+	void *ret = NULL;
 
 	if (INTERNAL_OBJ(a->c) == NULL)
 		return NULL;
@@ -541,14 +542,15 @@
 		a->version = p->version;
 		a->obj = p;
 		a->c_version = a->c->version;
+		ret = EXTERNAL_OBJ(p->astobj);
 		/* inc refcount of returned object */
-		ao2_ref(EXTERNAL_OBJ(p->astobj), 1);
+		ao2_ref(ret, 1);
 	}
 
 	if (!(a->flags & F_AO2I_DONTLOCK))
 		ao2_unlock(a->c);
 
-	return p ? EXTERNAL_OBJ(p->astobj) : NULL;
+	return ret;
 }
 
 /* callback for destroying container.