Fix crash in chanspy (bug #5332)

git-svn-id: http://svn.digium.com/svn/asterisk/trunk@6768 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 7 insertions, 19 deletions

diff --git a/apps/app_chanspy.c b/apps/app_chanspy.c
index 1c22ddb86..10f495945 100755
--- a/apps/app_chanspy.c
+++ b/apps/app_chanspy.c
@@ -255,8 +255,9 @@ static int spy_generate(struct ast_channel *chan, void *data, int len, int sampl
 	short buf0[1280], buf1[1280], buf[1280];
 		
 	if (csth->spy.status == CHANSPY_DONE) {
+		/* Channel is already gone more than likely */
 		return -1;
-        }
+	}
 
 	ast_mutex_lock(&csth->spy.lock);
 	while((f = csth->spy.queue[0])) {
@@ -326,7 +327,6 @@ static int spy_generate(struct ast_channel *chan, void *data, int len, int sampl
 	frame.datalen = x * 2;
 
 	if (ast_write(chan, &frame)) {
-		csth->spy.status = CHANSPY_DONE;
 		return -1;
 	}
 
@@ -373,24 +373,12 @@ static void stop_spying(struct ast_channel *chan, struct ast_channel_spy *spy)
 	struct ast_channel_spy *cptr=NULL, *prev=NULL;
 	int count = 0;
 
-	while(ast_mutex_trylock(&chan->lock)) {
-		/* if its locked already it's almost surely hanging up and we are too late 
-		   we can safely remove the head pointer if it points at us without needing a lock.
-		   since everybody spying will be in the same boat whomever is pointing at the head
-		   will surely erase it which is all we really need since it's a linked list of
-		   staticly declared structs that belong to each spy.
-		*/
-		if (chan->spiers == spy) {
-			chan->spiers = NULL;
-			return;
-		}
-		count++;
-		if (count > 10) {
-			return;
-		}
-		sched_yield();
-	}
+	/* If our status has changed, then the channel we're spying on is gone....
+	   DON'T TOUCH IT!!!  RUN AWAY!!! */
+	if (spy->status != CHANSPY_RUNNING)
+		return;
 
+	ast_mutex_lock(&chan->lock);
 	for(cptr=chan->spiers; cptr; cptr=cptr->next) {
 		if (cptr == spy) {
 			if (prev) {