diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-11-09 22:17:31 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-11-09 22:17:31 +0000 |
| commit | db78ad3def11acaae2dc1b2c204a27a7923fd195 (patch) | |
| tree | 7179e79859832ba85fc2db6a20c167b36c776f61 | |
| parent | abfad0f192a877e62869aff01c6da28d5eb29b52 (diff) | |
fixes segfault when transferring a queue caller
In sip_hangup we attempted to lock p->owner after we set it to NULL.
Thanks to fhackenberger for reporting the issue and submitting a patch.
(closes issue #15848)
Reported by: fhackenberger
Patches:
digium_bug_0015848 uploaded by fhackenberger (license 592)
Tested by: fhackenberger, lmadsen, TomS, shin-shoryuken, dvossel
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@229012 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_sip.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 0c5add6c8..2c107a420 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -6099,15 +6099,12 @@ static int sip_hangup(struct ast_channel *ast) * to lock the bridge. This may get hairy... */ while (bridge && ast_channel_trylock(bridge)) { - struct ast_channel *chan = p->owner; sip_pvt_unlock(p); do { - /* Use chan since p->owner could go NULL on us - * while p is unlocked - */ - CHANNEL_DEADLOCK_AVOIDANCE(chan); + /* Use oldowner since p->owner is already NULL */ + CHANNEL_DEADLOCK_AVOIDANCE(oldowner); } while (sip_pvt_trylock(p)); - bridge = p->owner ? ast_bridged_channel(p->owner) : NULL; + bridge = ast_bridged_channel(oldowner); } if (p->rtp) |