We have some bug reports showing crashes due to a double free of a channel.

Add a sanity check to ast_channel_free() to make sure we don't go on trying
to free a channel that wasn't found in the channel list.
(issue #8850, and others...)


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.2@67715 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 9 insertions, 7 deletions

diff --git a/channel.c b/channel.c
index 4c71ce3f6..5a520db43 100644
--- a/channel.c
+++ b/channel.c
@@ -897,14 +897,16 @@ void ast_channel_free(struct ast_channel *chan)
 		last = cur;
 		cur = cur->next;
 	}
-	if (!cur)
-		ast_log(LOG_WARNING, "Unable to find channel in list\n");
-	else {
-		/* Lock and unlock the channel just to be sure nobody
-		   has it locked still */
-		ast_mutex_lock(&cur->lock);
-		ast_mutex_unlock(&cur->lock);
+	if (!cur) {
+		ast_mutex_unlock(&chlock);
+		ast_log(LOG_ERROR, "Unable to find channel in list to free. Assuming it has already been done.\n");
+		return;
 	}
+
+	/* Lock and unlock the channel just to be sure nobody
+	   has it locked still */
+	ast_mutex_lock(&cur->lock);
+	ast_mutex_unlock(&cur->lock);
 	if (chan->tech_pvt) {
 		ast_log(LOG_WARNING, "Channel '%s' may not have been hung up properly\n", chan->name);
 		free(chan->tech_pvt);