[svn-commits] mjordan: branch 12 r414542 - /branches/12/main/core_unreal.c

[SVN commits to the Digium repositories]

Author: mjordan
Date: Sat May 24 21:30:51 2014
New Revision: 414542

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=414542
Log:
core_unreal: Prevent double free of core_unreal pvt

When a channel is destroyed (such as via ast_channel_release in off nominal
paths in core_unreal), it will attempt to free (via ast_free) the channel tech
pvt. This is problematic for a few reasons:
1. The channel tech pvt is an ao2 object in core_unreal. Free'ing the pvt
   directly is no good.
2. The channel tech pvt's reference count is dropped just prior to calling
   ast_channel_release, resulting in the pvt's destruction. Hence, the
   channel destructor is free'ing an invalid pointer.

This patch keeps the dropping of the reference count, but sets the pvt to
NULL on the channel prior to releasing it. This models what would occur if the
channel was hung up directly.

Modified:
    branches/12/main/core_unreal.c

Modified: branches/12/main/core_unreal.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/main/core_unreal.c?view=diff&rev=414542&r1=414541&r2=414542
==============================================================================
--- branches/12/main/core_unreal.c (original)
+++ branches/12/main/core_unreal.c Sat May 24 21:30:51 2014
@@ -955,6 +955,7 @@
 	if (ast_channel_cc_params_init(owner, requestor
 		? ast_channel_get_cc_config_params((struct ast_channel *) requestor) : NULL)) {
 		ao2_ref(p, -1);
+		ast_channel_tech_pvt_set(owner, NULL);
 		ast_channel_unlock(owner);
 		ast_channel_release(owner);
 		return NULL;
@@ -968,6 +969,7 @@
 			"%s/%s-%08x;2", tech->type, p->name, (unsigned)generated_seqno))) {
 		ast_log(LOG_WARNING, "Unable to allocate chan channel structure\n");
 		ao2_ref(p, -1);
+		ast_channel_tech_pvt_set(owner, NULL);
 		ast_channel_release(owner);
 		return NULL;
 	}