[asterisk-dev] Segfault in ast_readaudio_callback - Possible cause and solution.

[Steve Davies]

On 15 March 2012 21:24, Mark Michelson <mmichelson at digium.com> wrote:
> First off, thanks a bunch for the detailed analysis of the issue. From what
> I've seen, this definitely is an issue in later branches as well. See my
> comments in-line regarding your questions.
>
> On 03/15/2012 12:58 PM, Steve Davies wrote:

[snip]

>> 2) When calling ast_closestream(), set the stream->owner to NULL so it
>> is clear that the channel should no longer be used by that stream.
>
> This is probably the best way to go about this in the version you are using.
> However, in 1.8+, the better approach would be to make sure that when the
> filestream sets its owner, it bumps the refcount of the channel. This way,
> we won't need the extra if (s->owner) checks all over the place and we can
> safely refer to the channel throughout the life of the filestream. We just
> would need to be sure to decrement the refcount on the owner if either a)
> ast_applystream() is called with a new supplied channel or b) the filestream
> is destroyed.

[snip]


Many thanks for the rapid feedback.

I appreciate that 1.8 and 10 use ao2 ref-counting of channels, so was
aware that there would probably be a better patch for newer releases.
Glad to hear that the hunch was right :)

I have since tested the patch, and although it is hard to reproduce,
and feels even harder when running under gdb :(, I have demonstrated
to my own satisfaction that it does prevent this crash.

I'll upload the patch to the issue tracker ASAP.

Regards,
Steve