[asterisk-commits] dvossel: branch 1.6.1 r220371 - in /branches/1.6.1: ./ main/tcptls.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Thu Sep 24 15:38:31 2009
New Revision: 220371

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=220371
Log:
Merged revisions 220365 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

........
  r220365 | dvossel | 2009-09-24 15:37:20 -0500 (Thu, 24 Sep 2009) | 8 lines
  
  fixes tcptls_session memory leak caused by ref count error
  
  (closes issue #15939)
  Reported by: dvossel
  
  Review: https://reviewboard.asterisk.org/r/375/
........

Modified:
    branches/1.6.1/   (props changed)
    branches/1.6.1/main/tcptls.c

Propchange: branches/1.6.1/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.1/main/tcptls.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.6.1/main/tcptls.c?view=diff&rev=220371&r1=220370&r2=220371
==============================================================================
--- branches/1.6.1/main/tcptls.c (original)
+++ branches/1.6.1/main/tcptls.c Thu Sep 24 15:38:31 2009
@@ -122,6 +122,8 @@
 * creates a FILE * from the fd passed by the accept thread.
 * This operation is potentially expensive (certificate verification),
 * so we do it in the child thread context.
+*
+* \note must decrement ref count before returning NULL on error
 */
 static void *handle_tls_connection(void *data)
 {
@@ -196,6 +198,7 @@
 						if (peer)
 							X509_free(peer);
 						fclose(tcptls_session->f);
+						ao2_ref(tcptls_session, -1);
 						return NULL;
 					}
 				}
@@ -262,6 +265,7 @@
 
 		tcptls_session->client = 0;
 			
+		/* This thread is now the only place that controls the single ref to tcptls_session */
 		if (ast_pthread_create_detached_background(&launched, NULL, handle_tls_connection, tcptls_session)) {
 			ast_log(LOG_WARNING, "Unable to launch helper thread: %s\n", strerror(errno));
 			close(tcptls_session->fd);
@@ -391,8 +395,9 @@
 		__ssl_setup(desc->tls_cfg, 1);
 	}
 
-	ao2_ref(tcptls_session, +1);
-	if (!handle_tls_connection(tcptls_session))
+	/* handle_tls_connection controls the single ref to tcptls_session. If
+	 * tcptls_session returns NULL then the session has been destroyed */
+	if (!(tcptls_session = handle_tls_connection(tcptls_session)))
 		goto error;
 
 	return tcptls_session;