[asterisk-commits] mjordan: branch 1.8 r379091 - /branches/1.8/bridges/bridge_softmix.c

[SVN commits to the Asterisk project]

Author: mjordan
Date: Mon Jan 14 21:46:57 2013
New Revision: 379091

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=379091
Log:
Prevent crash in ConfBridge due to race condition when channels leave bridge

When a channel leaves a bridge, a race condition existed where the
bridge_channel's pvt structure would be accessed after it was disposed of.
This patch prevents that by setting the pointer to the pvt to NULL prior
to disposing of it.

Note that this patch is a backport from Asterisk 10. This particular race
condition was fixed as part of the larger code rework that occurred for that
release.

The solution to this problem was pointed out by Gunnar Harms in ASTERISK-16640.

(closes issue ASTERISK-16640)
Reported by: thomas987

(closes issue ASTERISK-16835)
Reported by: saghul

Modified:
    branches/1.8/bridges/bridge_softmix.c

Modified: branches/1.8/bridges/bridge_softmix.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.8/bridges/bridge_softmix.c?view=diff&rev=379091&r1=379090&r2=379091
==============================================================================
--- branches/1.8/bridges/bridge_softmix.c (original)
+++ branches/1.8/bridges/bridge_softmix.c Mon Jan 14 21:46:57 2013
@@ -149,6 +149,11 @@
 {
 	struct softmix_channel *sc = bridge_channel->bridge_pvt;
 
+	if (!(bridge_channel->bridge_pvt)) {
+		return 0;
+	}
+	bridge_channel->bridge_pvt = NULL;
+
 	/* Drop mutex lock */
 	ast_mutex_destroy(&sc->lock);