[svn-commits] russell: branch 1.6.0 r120170 - in /branches/1.6.0: ./ channels/chan_iax2.c

[SVN commits to the Digium repositories]

Author: russell
Date: Tue Jun  3 16:35:46 2008
New Revision: 120170

URL: http://svn.digium.com/view/asterisk?view=rev&rev=120170
Log:
Merged revisions 120169 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
r120169 | russell | 2008-06-03 16:35:11 -0500 (Tue, 03 Jun 2008) | 12 lines

Merged revisions 120168 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r120168 | russell | 2008-06-03 16:34:55 -0500 (Tue, 03 Jun 2008) | 4 lines

Fix another place where peer->callno could change at a very bad time, and also
fix a place where a peer was used after the reference was released.
(inspired by rev 120001)

........

................

Modified:
    branches/1.6.0/   (props changed)
    branches/1.6.0/channels/chan_iax2.c

Propchange: branches/1.6.0/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.0/channels/chan_iax2.c
URL: http://svn.digium.com/view/asterisk/branches/1.6.0/channels/chan_iax2.c?view=diff&rev=120170&r1=120169&r2=120170
==============================================================================
--- branches/1.6.0/channels/chan_iax2.c (original)
+++ branches/1.6.0/channels/chan_iax2.c Tue Jun  3 16:35:46 2008
@@ -9699,15 +9699,17 @@
 static void __iax2_poke_noanswer(const void *data)
 {
 	struct iax2_peer *peer = (struct iax2_peer *)data;
+	int callno;
+
 	if (peer->lastms > -1) {
 		ast_log(LOG_NOTICE, "Peer '%s' is now UNREACHABLE! Time: %d\n", peer->name, peer->lastms);
 		manager_event(EVENT_FLAG_SYSTEM, "PeerStatus", "ChannelType: IAX2\r\nPeer: IAX2/%s\r\nPeerStatus: Unreachable\r\nTime: %d\r\n", peer->name, peer->lastms);
 		ast_device_state_changed("IAX2/%s", peer->name); /* Activate notification */
 	}
-	if (peer->callno > 0) {
-		ast_mutex_lock(&iaxsl[peer->callno]);
-		iax2_destroy(peer->callno);
-		ast_mutex_unlock(&iaxsl[peer->callno]);
+	if ((callno = peer->callno) > 0) {
+		ast_mutex_lock(&iaxsl[callno]);
+		iax2_destroy(callno);
+		ast_mutex_unlock(&iaxsl[callno]);
 	}
 	peer->callno = 0;
 	peer->lastms = -1;
@@ -9760,7 +9762,7 @@
 	}
 	if (heldcall)
 		ast_mutex_unlock(&iaxsl[heldcall]);
-	peer->callno = find_callno(0, 0, &peer->addr, NEW_FORCE, peer->sockfd, 0);
+	callno = peer->callno = find_callno(0, 0, &peer->addr, NEW_FORCE, peer->sockfd, 0);
 	if (heldcall)
 		ast_mutex_lock(&iaxsl[heldcall]);
 	if (peer->callno < 1) {
@@ -9790,7 +9792,11 @@
  		peer_unref(peer);
 
 	/* And send the poke */
-	send_command(iaxs[peer->callno], AST_FRAME_IAX, IAX_COMMAND_POKE, 0, NULL, 0, -1);
+	ast_mutex_lock(&iaxsl[callno]);
+	if (iaxs[callno]) {
+		send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_POKE, 0, NULL, 0, -1);
+	}
+	ast_mutex_unlock(&iaxsl[callno]);
 
 	return 0;
 }