When deleting a task from the scheduler, ignoring the return value could

possibly cause memory to be accessed after it is freed, which causes all
sorts of random memory corruption.  Instead, if a deletion fails, wait a
bit and try again (noting that another thread could change our taskid
value).
(closes issue #11386)
 Reported by: flujan
 Patches: 
       20080124__bug11386.diff.txt uploaded by Corydon76 (license 14)
 Tested by: Corydon76, flujan, stuarth`


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@100465 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 5 insertions, 14 deletions

diff --git a/channels/chan_h323.c b/channels/chan_h323.c
index 1e0a45683..bcde79a79 100644
--- a/channels/chan_h323.c
+++ b/channels/chan_h323.c
@@ -373,14 +373,12 @@ static void __oh323_update_info(struct ast_channel *c, struct oh323_pvt *pvt)
 		if (pvt->newdigit == ' ') {		/* signalUpdate message */
 			f.subclass = pvt->curDTMF;
 			if (pvt->DTMFsched >= 0) {
-				ast_sched_del(sched, pvt->DTMFsched);
-				pvt->DTMFsched = -1;
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 			}
 		} else {						/* Regular input or signal message */
 			if (pvt->newduration) {		/* This is a signal, signalUpdate follows */
 				f.frametype = AST_FRAME_DTMF_BEGIN;
-				if (pvt->DTMFsched >= 0)
-					ast_sched_del(sched, pvt->DTMFsched);
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 				pvt->DTMFsched = ast_sched_add(sched, pvt->newduration, oh323_simulate_dtmf_end, pvt);
 				if (h323debug)
 					ast_log(LOG_DTMF, "Scheduled DTMF END simulation for %d ms, id=%d\n", pvt->newduration, pvt->DTMFsched);
@@ -453,10 +451,7 @@ static void __oh323_destroy(struct oh323_pvt *pvt)
 {
 	struct oh323_pvt *cur, *prev = NULL;
 
-	if (pvt->DTMFsched >= 0) {
-		ast_sched_del(sched, pvt->DTMFsched);
-		pvt->DTMFsched = -1;
-	}
+	AST_SCHED_DEL(sched, pvt->DTMFsched);
 
 	if (pvt->rtp) {
 		ast_rtp_destroy(pvt->rtp);
@@ -1796,15 +1791,11 @@ static int receive_digit(unsigned call_reference, char digit, const char *token,
 			};
 			if (digit == ' ') {		/* signalUpdate message */
 				f.subclass = pvt->curDTMF;
-				if (pvt->DTMFsched >= 0) {
-					ast_sched_del(sched, pvt->DTMFsched);
-					pvt->DTMFsched = -1;
-				}
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 			} else {				/* Regular input or signal message */
 				if (pvt->DTMFsched >= 0) {
 					/* We still don't send DTMF END from previous event, send it now */
-					ast_sched_del(sched, pvt->DTMFsched);
-					pvt->DTMFsched = -1;
+					AST_SCHED_DEL(sched, pvt->DTMFsched);
 					f.subclass = pvt->curDTMF;
 					f.samples = f.len = 0;
 					ast_queue_frame(pvt->owner, &f);