[asterisk-commits] bebuild: tag 1.8.12.2 r367963 - in /tags/1.8.12.2: ./ channels/

[SVN commits to the Asterisk project]

Author: bebuild
Date: Wed May 30 09:22:24 2012
New Revision: 367963

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=367963
Log:
Merge r367266 for 1.8.12.2

Removed:
    tags/1.8.12.2/asterisk-1.8.12.1-summary.html
    tags/1.8.12.2/asterisk-1.8.12.1-summary.txt
Modified:
    tags/1.8.12.2/   (props changed)
    tags/1.8.12.2/.version
    tags/1.8.12.2/ChangeLog
    tags/1.8.12.2/channels/chan_sip.c

Propchange: tags/1.8.12.2/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed May 30 09:22:24 2012
@@ -1,1 +1,1 @@
-/branches/1.8:363102,363106,363141,364706,367781,367843
+/branches/1.8:363102,363106,363141,364706,367266,367781,367843

Modified: tags/1.8.12.2/.version
URL: http://svnview.digium.com/svn/asterisk/tags/1.8.12.2/.version?view=diff&rev=367963&r1=367962&r2=367963
==============================================================================
--- tags/1.8.12.2/.version (original)
+++ tags/1.8.12.2/.version Wed May 30 09:22:24 2012
@@ -1,1 +1,1 @@
-1.8.12.1
+1.8.12.2

Modified: tags/1.8.12.2/ChangeLog
URL: http://svnview.digium.com/svn/asterisk/tags/1.8.12.2/ChangeLog?view=diff&rev=367963&r1=367962&r2=367963
==============================================================================
--- tags/1.8.12.2/ChangeLog (original)
+++ tags/1.8.12.2/ChangeLog Wed May 30 09:22:24 2012
@@ -1,3 +1,19 @@
+2012-05-30  Asterisk Development Team <asteriskteam at digium.com>
+
+	* Asterisk 1.8.12.2 Released.
+
+	* Resolve crash in subscribing for MWI notifications.
+
+	  ASTOBJ_UNREF sets the variable to NULL after unreffing it, so the
+	  variable should definitely not be used after that. To solve this in
+	  the two cases that affect subscribing for MWI notifications, we
+	  instead save the ref locally, and unref them in the error
+	  conditions.
+
+	  (closes issue ASTERISK-19827)
+	  Reported by: B. R.
+	  Review: https://reviewboard.asterisk.org/r/1940/
+
 2012-05-29  Asterisk Development Team <asteriskteam at digium.com>
 
 	* Asterisk 1.8.12.1 Released.

Modified: tags/1.8.12.2/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/tags/1.8.12.2/channels/chan_sip.c?view=diff&rev=367963&r1=367962&r2=367963
==============================================================================
--- tags/1.8.12.2/channels/chan_sip.c (original)
+++ tags/1.8.12.2/channels/chan_sip.c Wed May 30 09:22:24 2012
@@ -12408,13 +12408,14 @@
 	/* If we have no DNS manager let's do a lookup */
 	if (!mwi->dnsmgr) {
 		char transport[MAXHOSTNAMELEN];
+		struct sip_subscription_mwi *saved;
 		snprintf(transport, sizeof(transport), "_%s._%s", get_srv_service(mwi->transport), get_srv_protocol(mwi->transport));
 
 		mwi->us.ss.ss_family = get_address_family_filter(&bindaddr); /* Filter address family */
-		ASTOBJ_REF(mwi); /* Add a ref for storing the mwi on the dnsmgr for updates */
-		ast_dnsmgr_lookup_cb(mwi->hostname, &mwi->us, &mwi->dnsmgr, sip_cfg.srvlookup ? transport : NULL, on_dns_update_mwi, mwi);
+		saved = ASTOBJ_REF(mwi);
+		ast_dnsmgr_lookup_cb(mwi->hostname, &mwi->us, &mwi->dnsmgr, sip_cfg.srvlookup ? transport : NULL, on_dns_update_mwi, saved);
 		if (!mwi->dnsmgr) {
-			ASTOBJ_UNREF(mwi, sip_subscribe_mwi_destroy); /* dnsmgr disabled, remove reference */
+			ASTOBJ_UNREF(saved, sip_subscribe_mwi_destroy); /* dnsmgr disabled, remove reference */
 		}
 	}
 
@@ -29557,10 +29558,12 @@
 static void sip_send_all_mwi_subscriptions(void)
 {
 	ASTOBJ_CONTAINER_TRAVERSE(&submwil, 1, do {
+		struct sip_subscription_mwi *saved;
 		ASTOBJ_WRLOCK(iterator);
 		AST_SCHED_DEL(sched, iterator->resub);
-		if ((iterator->resub = ast_sched_add(sched, 1, sip_subscribe_mwi_do, ASTOBJ_REF(iterator))) < 0) {
-			ASTOBJ_UNREF(iterator, sip_subscribe_mwi_destroy);
+		saved = ASTOBJ_REF(iterator);
+		if ((iterator->resub = ast_sched_add(sched, 1, sip_subscribe_mwi_do, saved)) < 0) {
+			ASTOBJ_UNREF(saved, sip_subscribe_mwi_destroy);
 		}
 		ASTOBJ_UNLOCK(iterator);
 	} while (0));