diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-11-07 23:39:37 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-11-07 23:39:37 +0000 |
commit | d7a7df7cb6fc9a36a305d6455d246f8c5beae22e (patch) | |
tree | 7b6695fe8e59d37f395a3a939ca50a4391c9991e /apps/app_queue.c | |
parent | 495e7a79b8aecce74774ceeb8cede66c2800ef32 (diff) |
The member refcount must be incremented, to avoid using it after deallocation.
A huge thanks go to lvl- for patiently providing the necessary valgrind output
that was necessary to finding this problem of memory corruption.
Reported by: lvl-
Patch by: tilghman
Closes issue #11174
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@89093 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'apps/app_queue.c')
-rw-r--r-- | apps/app_queue.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/apps/app_queue.c b/apps/app_queue.c index 95a98df68..875afdaa4 100644 --- a/apps/app_queue.c +++ b/apps/app_queue.c @@ -2622,6 +2622,8 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce callcompletedinsl = ((now - qe->start) <= qe->parent->servicelevel); ast_mutex_unlock(&qe->parent->lock); member = lpeer->member; + /* Increment the refcount for this member, since we're going to be using it for awhile in here. */ + ao2_ref(member, 1); hangupcalls(outgoing, peer); outgoing = NULL; if (announce || qe->parent->reportholdtime || qe->parent->memberdelay) { @@ -2668,6 +2670,7 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce queuename, qe->chan->uniqueid, peer->name, member->interface, member->membername, qe->parent->eventwhencalled == QUEUE_EVENT_VARIABLES ? vars2manager(qe->chan, vars, sizeof(vars)) : ""); ast_hangup(peer); + ao2_ref(member, -1); goto out; } else if (res2) { /* Caller must have hung up just before being connected*/ @@ -2675,6 +2678,7 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce ast_queue_log(queuename, qe->chan->uniqueid, member->membername, "ABANDON", "%d|%d|%ld", qe->pos, qe->opos, (long)time(NULL) - qe->start); record_abandoned(qe); ast_hangup(peer); + ao2_ref(member, -1); return -1; } } @@ -2690,6 +2694,7 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce ast_log(LOG_WARNING, "Had to drop call because I couldn't make %s compatible with %s\n", qe->chan->name, peer->name); record_abandoned(qe); ast_hangup(peer); + ao2_ref(member, -1); return -1; } @@ -2874,6 +2879,7 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce ast_hangup(peer); update_queue(qe->parent, member, callcompletedinsl); res = bridge ? bridge : 1; + ao2_ref(member, -1); } out: hangupcalls(outgoing, NULL); |