[asterisk-commits] sgriepentrog: branch 12 r430199 - /branches/12/main/bridge_basic.c

[SVN commits to the Asterisk project]

Author: sgriepentrog
Date: Mon Jan  5 16:49:11 2015
New Revision: 430199

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=430199
Log:
bridge: avoid leaking channel during blond transfer pt2

A blond transfer to a failed destination, when followed
by a recall attempt, lead to a leak of the reference to
the destination channel.  In addition to correcting the
regression on the previous attempt (r429826) this fixes
the leak and two additional reference leaks on failures
of bridge_import.

ASTERISK-24513 #close
Review: https://reviewboard.asterisk.org/r/4302/


Modified:
    branches/12/main/bridge_basic.c

Modified: branches/12/main/bridge_basic.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/main/bridge_basic.c?view=diff&rev=430199&r1=430198&r2=430199
==============================================================================
--- branches/12/main/bridge_basic.c (original)
+++ branches/12/main/bridge_basic.c Mon Jan  5 16:49:11 2015
@@ -1319,7 +1319,10 @@
 	struct ast_channel *transfer_target;
 	/*! The party that is currently being recalled. Depending on
 	 * the current state, this may be either the party that originally
-	 * was the transferer or the original transfer target
+	 * was the transferer or the original transfer target.  This is
+	 * set with reference when entering the BLOND_NONFINAL, RECALLING,
+	 * and RETRANSFER states, and the reference released on state exit
+	 * if continuing with recall or retransfer to avoid leak.
 	 */
 	struct ast_channel *recall_target;
 	/*! The absolute starting time for running timers */
@@ -2259,10 +2262,10 @@
 {
 	int res;
 	props->superstate = SUPERSTATE_RECALL;
+	/* move the transfer target to the recall target along with its reference */
 	props->recall_target = ast_channel_ref(props->transfer_target);
 	res = blond_enter(props);
-	/* transfer properties holds a separate reference to transfer_target, don't set it to NULL here */
-	ast_channel_unref(props->transfer_target);
+	props->transfer_target = ast_channel_unref(props->transfer_target);
 	return res;
 }
 
@@ -2276,8 +2279,8 @@
 		return TRANSFER_RESUME;
 	case STIMULUS_TIMEOUT:
 		ast_softhangup(props->recall_target, AST_SOFTHANGUP_EXPLICIT);
+	case STIMULUS_RECALL_TARGET_HANGUP:
 		props->recall_target = ast_channel_unref(props->recall_target);
-	case STIMULUS_RECALL_TARGET_HANGUP:
 		return TRANSFER_RECALLING;
 	case STIMULUS_NONE:
 	case STIMULUS_DTMF_ATXFER_ABORT:
@@ -2406,6 +2409,7 @@
 		if (ast_bridge_impart(props->transferee_bridge, props->recall_target, NULL, NULL,
 			AST_BRIDGE_IMPART_CHAN_INDEPENDENT)) {
 			ast_hangup(props->recall_target);
+			ast_channel_unref(props->recall_target);
 			return TRANSFER_FAIL;
 		}
 		return TRANSFER_RESUME;
@@ -2499,6 +2503,7 @@
 		AST_BRIDGE_IMPART_CHAN_INDEPENDENT)) {
 		ast_log(LOG_ERROR, "Unable to place recall target into bridge\n");
 		ast_hangup(props->recall_target);
+		ast_channel_unref(props->recall_target);
 		return -1;
 	}