[asterisk-commits] file: branch 12 r403542 - /branches/12/main/endpoints.c

[SVN commits to the Asterisk project]

Author: file
Date: Mon Dec  9 12:31:13 2013
New Revision: 403542

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=403542
Log:
endpoints: Keep a reference to channel ids when creating snapshot.

The snapshot process for endpoints uses the channel ids present
on the endpoint itself. Without keeping a reference it was possible
for the strings to be freed underneath any consumer of an endpoint
snapshot.

A reference is now held by the snapshot to the channel ids and
released when the snapshot is destroyed.

(issue ASTERISK-22801)
Reported by: Matt Jordan

Modified:
    branches/12/main/endpoints.c

Modified: branches/12/main/endpoints.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/main/endpoints.c?view=diff&rev=403542&r1=403541&r2=403542
==============================================================================
--- branches/12/main/endpoints.c (original)
+++ branches/12/main/endpoints.c Mon Dec  9 12:31:13 2013
@@ -388,8 +388,14 @@
 static void endpoint_snapshot_dtor(void *obj)
 {
 	struct ast_endpoint_snapshot *snapshot = obj;
+	int channel;
 
 	ast_assert(snapshot != NULL);
+
+	for (channel = 0; channel < snapshot->num_channels; channel++) {
+		ao2_ref(snapshot->channel_ids[channel], -1);
+	}
+
 	ast_string_field_free_memory(snapshot);
 }
 
@@ -422,8 +428,8 @@
 
 	i = ao2_iterator_init(endpoint->channel_ids, 0);
 	while ((obj = ao2_iterator_next(&i))) {
-		RAII_VAR(char *, channel_id, obj, ao2_cleanup);
-		snapshot->channel_ids[snapshot->num_channels++] = channel_id;
+		/* The reference is kept so the channel id does not go away until the snapshot is gone */
+		snapshot->channel_ids[snapshot->num_channels++] = obj;
 	}
 	ao2_iterator_destroy(&i);