[asterisk-dev] Segfault in ast_readaudio_callback - Possible cause and solution.

[Mark Michelson]

First off, thanks a bunch for the detailed analysis of the issue. From 
what I've seen, this definitely is an issue in later branches as well. 
See my comments in-line regarding your questions.

On 03/15/2012 12:58 PM, Steve Davies wrote:
> Proposed solution:
>
> 1) Increase the refcount on the ast_filestream while in
> ast_readaudio_callback so that it is not freed from under it.
This is definitely the correct approach.
> 2) When calling ast_closestream(), set the stream->owner to NULL so it
> is clear that the channel should no longer be used by that stream.
This is probably the best way to go about this in the version you are 
using. However, in 1.8+, the better approach would be to make sure that 
when the filestream sets its owner, it bumps the refcount of the 
channel. This way, we won't need the extra if (s->owner) checks all over 
the place and we can safely refer to the channel throughout the life of 
the filestream. We just would need to be sure to decrement the refcount 
on the owner if either a) ast_applystream() is called with a new 
supplied channel or b) the filestream is destroyed.
> My greatest concern is that I have no feeling for how much extra load
> ao2_ref/ao2_unref adds? I've attached a sample patch (for 1.6.2...
> sorry!), which I can upload and disclaim if anyone thinks that it is
> useful to do so. I have a site where this issue happens once a day at
> the moment!
Regarding load, all ao2_ref does is increment a counter for the object. 
It's very lightweight. Definitely upload this patch on the bugtracker 
because we cannot accept out-of-band contributions like this.

> Thoughts please?
>
> Regards,
> Steve
>
> PS. Yes, I am trying to get us moved up to Asterisk 1.8 ASAP :)
Good :)
Mark Michelson