[svn-commits] mmichelson: branch 1.8 r372089 - /branches/1.8/apps/app_queue.c

[SVN commits to the Digium repositories]

Author: mmichelson
Date: Thu Aug 30 15:51:51 2012
New Revision: 372089

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=372089
Log:
Prevent crash on shutdown due to refcount error on queues container.

When app_queue is unloaded, the queues container has its refcount
decremented, potentially to 0. Then the taskprocessor responsible
for handling device state changes is unreferenced. If the
taskprocessor happens to be just about to run its task, then it
will create and destroy an iterator on the queues container.
This can cause the refcount on the queues container to increase to
1 and then back to 0. Going back to 0 a second time results in
double frees.


Modified:
    branches/1.8/apps/app_queue.c

Modified: branches/1.8/apps/app_queue.c
URL: http://svnview.digium.com/svn/asterisk/branches/1.8/apps/app_queue.c?view=diff&rev=372089&r1=372088&r2=372089
==============================================================================
--- branches/1.8/apps/app_queue.c (original)
+++ branches/1.8/apps/app_queue.c Thu Aug 30 15:51:51 2012
@@ -8404,8 +8404,8 @@
 		queue_t_unref(q, "Done with iterator");
 	}
 	ao2_iterator_destroy(&q_iter);
+	devicestate_tps = ast_taskprocessor_unreference(devicestate_tps);
 	ao2_ref(queues, -1);
-	devicestate_tps = ast_taskprocessor_unreference(devicestate_tps);
 	ast_unload_realtime("queue_members");
 	return res;
 }