[asterisk-commits] mmichelson: branch 1.6.0 r114114 - in /branches/1.6.0: ./ apps/

SVN commits to the Asterisk project asterisk-commits at lists.digium.com
Mon Apr 14 11:25:57 CDT 2008


Author: mmichelson
Date: Mon Apr 14 11:25:57 2008
New Revision: 114114

URL: http://svn.digium.com/view/asterisk?view=rev&rev=114114
Log:
Merged revisions 114113 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
r114113 | mmichelson | 2008-04-14 11:25:09 -0500 (Mon, 14 Apr 2008) | 17 lines

Merged revisions 114112 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r114112 | mmichelson | 2008-04-14 11:24:22 -0500 (Mon, 14 Apr 2008) | 9 lines

If the datastore has been moved to another channel due to a masquerade, then
freeing the datastore here causes an eventual double free when the new channel
hangs up. We should only free the datastore if we were able to successfully remove
it from the channel we are referencing (i.e. the datastore was not moved).

(closes issue #12359)
Reported by: pguido


........

................

Modified:
    branches/1.6.0/   (props changed)
    branches/1.6.0/apps/app_dial.c
    branches/1.6.0/apps/app_queue.c

Propchange: branches/1.6.0/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.0/apps/app_dial.c
URL: http://svn.digium.com/view/asterisk/branches/1.6.0/apps/app_dial.c?view=diff&rev=114114&r1=114113&r2=114114
==============================================================================
--- branches/1.6.0/apps/app_dial.c (original)
+++ branches/1.6.0/apps/app_dial.c Mon Apr 14 11:25:57 2008
@@ -1590,8 +1590,14 @@
 	time(&start_time);
 	peer = wait_for_answer(chan, outgoing, &to, peerflags, &pa, &num, &result);
 
-	ast_channel_datastore_remove(chan, datastore);
-	ast_channel_datastore_free(datastore);
+	/* The ast_channel_datastore_remove() function could fail here if the
+	 * datastore was moved to another channel during a masquerade. If this is
+	 * the case, don't free the datastore here because later, when the channel
+	 * to which the datastore was moved hangs up, it will attempt to free this
+	 * datastore again, causing a crash
+	 */
+	if (!ast_channel_datastore_remove(chan, datastore))
+		ast_channel_datastore_free(datastore);
 	if (!peer) {
 		if (result) {
 			res = result;

Modified: branches/1.6.0/apps/app_queue.c
URL: http://svn.digium.com/view/asterisk/branches/1.6.0/apps/app_queue.c?view=diff&rev=114114&r1=114113&r2=114114
==============================================================================
--- branches/1.6.0/apps/app_queue.c (original)
+++ branches/1.6.0/apps/app_queue.c Mon Apr 14 11:25:57 2008
@@ -3243,8 +3243,13 @@
 	if (use_weight)
 		ao2_unlock(queues);
 	lpeer = wait_for_answer(qe, outgoing, &to, &digit, numbusies, ast_test_flag(&(bridge_config.features_caller), AST_FEATURE_DISCONNECT), forwardsallowed);
-	if (datastore) {
-		ast_channel_datastore_remove(qe->chan, datastore);
+	/* The ast_channel_datastore_remove() function could fail here if the
+	 * datastore was moved to another channel during a masquerade. If this is
+	 * the case, don't free the datastore here because later, when the channel
+	 * to which the datastore was moved hangs up, it will attempt to free this
+	 * datastore again, causing a crash
+	 */
+	if (datastore && !ast_channel_datastore_remove(qe->chan, datastore)) {
 		ast_channel_datastore_free(datastore);
 	}
 	ao2_lock(qe->parent);




More information about the asterisk-commits mailing list