[asterisk-commits] dvossel: trunk r263151 - /trunk/channels/chan_iax2.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Fri May 14 13:53:55 2010
New Revision: 263151

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=263151
Log:
fix iax_frame double free

Very unfortunate things happen if we add an iax_frame
to the frame queue and let go of the lock before scheduling
the frame's transmit... There is a race condition that
exists where the frame can be removed from the frame_queue
and freed before the transmit is scheduled if we do not
hold on to that lock.  This results in a freed frame
being scheduled for transmit later.


Modified:
    trunk/channels/chan_iax2.c

Modified: trunk/channels/chan_iax2.c
URL: http://svnview.digium.com/svn/asterisk/trunk/channels/chan_iax2.c?view=diff&rev=263151&r1=263150&r2=263151
==============================================================================
--- trunk/channels/chan_iax2.c (original)
+++ trunk/channels/chan_iax2.c Fri May 14 13:53:55 2010
@@ -4125,9 +4125,9 @@
 	} else {
 		/* We need reliable delivery.  Schedule a retransmission */
 		AST_LIST_INSERT_TAIL(&frame_queue[fr->callno], fr, list);
-		ast_mutex_unlock(&iaxsl[fr->callno]);
 		fr->retries++;
 		fr->retrans = iax2_sched_add(sched, fr->retrytime, attempt_transmit, fr);
+		ast_mutex_unlock(&iaxsl[fr->callno]);
 	}
 
 	return 0;