[svn-commits] tilghman: trunk r89094 - in /trunk: ./ apps/app_queue.c

[SVN commits to the Digium repositories]

Author: tilghman
Date: Wed Nov  7 17:47:45 2007
New Revision: 89094

URL: http://svn.digium.com/view/asterisk?view=rev&rev=89094
Log:
Merged revisions 89093 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r89093 | tilghman | 2007-11-07 17:39:37 -0600 (Wed, 07 Nov 2007) | 7 lines

The member refcount must be incremented, to avoid using it after deallocation.
A huge thanks go to lvl- for patiently providing the necessary valgrind output
that was necessary to finding this problem of memory corruption.
Reported by: lvl-
Patch by: tilghman
Closes issue #11174

........

Modified:
    trunk/   (props changed)
    trunk/apps/app_queue.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: trunk/apps/app_queue.c
URL: http://svn.digium.com/view/asterisk/trunk/apps/app_queue.c?view=diff&rev=89094&r1=89093&r2=89094
==============================================================================
--- trunk/apps/app_queue.c (original)
+++ trunk/apps/app_queue.c Wed Nov  7 17:47:45 2007
@@ -2836,6 +2836,8 @@
 		callcompletedinsl = ((now - qe->start) <= qe->parent->servicelevel);
 		ao2_unlock(qe->parent);
 		member = lpeer->member;
+		/* Increment the refcount for this member, since we're going to be using it for awhile in here. */
+		ao2_ref(member, 1);
 		hangupcalls(outgoing, peer);
 		outgoing = NULL;
 		if (announce || qe->parent->reportholdtime || qe->parent->memberdelay) {
@@ -2882,6 +2884,7 @@
 							queuename, qe->chan->uniqueid, peer->name, member->interface, member->membername,
 							qe->parent->eventwhencalled == QUEUE_EVENT_VARIABLES ? vars2manager(qe->chan, vars, sizeof(vars)) : "");
 				ast_hangup(peer);
+				ao2_ref(member, -1);
 				goto out;
 			} else if (res2) {
 				/* Caller must have hung up just before being connected*/
@@ -2889,6 +2892,7 @@
 				ast_queue_log(queuename, qe->chan->uniqueid, member->membername, "ABANDON", "%d|%d|%ld", qe->pos, qe->opos, (long) time(NULL) - qe->start);
 				record_abandoned(qe);
 				ast_hangup(peer);
+				ao2_ref(member, -1);
 				return -1;
 			}
 		}
@@ -2907,6 +2911,7 @@
 			ast_log(LOG_WARNING, "Had to drop call because I couldn't make %s compatible with %s\n", qe->chan->name, peer->name);
 			record_abandoned(qe);
 			ast_hangup(peer);
+			ao2_ref(member, -1);
 			return -1;
 		}
 
@@ -3190,6 +3195,7 @@
 			ast_hangup(peer);
 		update_queue(qe->parent, member, callcompletedinsl);
 		res = bridge ? bridge : 1;
+		ao2_ref(member, -1);
 	}
 out:
 	hangupcalls(outgoing, NULL);