diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-27 21:59:53 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-27 21:59:53 +0000 |
commit | 940f913146cc96cda9132600151d40ee85680ee6 (patch) | |
tree | a0610b66a954f2b2f98aedcd42cbc2b4250184b8 /channels/chan_h323.c | |
parent | 74e414e5f2dbf490e4c2f67ce638e0ec9e4ad0ae (diff) |
When deleting a task from the scheduler, ignoring the return value could
possibly cause memory to be accessed after it is freed, which causes all
sorts of random memory corruption. Instead, if a deletion fails, wait a
bit and try again (noting that another thread could change our taskid
value).
(closes issue #11386)
Reported by: flujan
Patches:
20080124__bug11386.diff.txt uploaded by Corydon76 (license 14)
Tested by: Corydon76, flujan, stuarth`
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@100465 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels/chan_h323.c')
-rw-r--r-- | channels/chan_h323.c | 19 |
1 files changed, 5 insertions, 14 deletions
diff --git a/channels/chan_h323.c b/channels/chan_h323.c index 1e0a45683..bcde79a79 100644 --- a/channels/chan_h323.c +++ b/channels/chan_h323.c @@ -373,14 +373,12 @@ static void __oh323_update_info(struct ast_channel *c, struct oh323_pvt *pvt) if (pvt->newdigit == ' ') { /* signalUpdate message */ f.subclass = pvt->curDTMF; if (pvt->DTMFsched >= 0) { - ast_sched_del(sched, pvt->DTMFsched); - pvt->DTMFsched = -1; + AST_SCHED_DEL(sched, pvt->DTMFsched); } } else { /* Regular input or signal message */ if (pvt->newduration) { /* This is a signal, signalUpdate follows */ f.frametype = AST_FRAME_DTMF_BEGIN; - if (pvt->DTMFsched >= 0) - ast_sched_del(sched, pvt->DTMFsched); + AST_SCHED_DEL(sched, pvt->DTMFsched); pvt->DTMFsched = ast_sched_add(sched, pvt->newduration, oh323_simulate_dtmf_end, pvt); if (h323debug) ast_log(LOG_DTMF, "Scheduled DTMF END simulation for %d ms, id=%d\n", pvt->newduration, pvt->DTMFsched); @@ -453,10 +451,7 @@ static void __oh323_destroy(struct oh323_pvt *pvt) { struct oh323_pvt *cur, *prev = NULL; - if (pvt->DTMFsched >= 0) { - ast_sched_del(sched, pvt->DTMFsched); - pvt->DTMFsched = -1; - } + AST_SCHED_DEL(sched, pvt->DTMFsched); if (pvt->rtp) { ast_rtp_destroy(pvt->rtp); @@ -1796,15 +1791,11 @@ static int receive_digit(unsigned call_reference, char digit, const char *token, }; if (digit == ' ') { /* signalUpdate message */ f.subclass = pvt->curDTMF; - if (pvt->DTMFsched >= 0) { - ast_sched_del(sched, pvt->DTMFsched); - pvt->DTMFsched = -1; - } + AST_SCHED_DEL(sched, pvt->DTMFsched); } else { /* Regular input or signal message */ if (pvt->DTMFsched >= 0) { /* We still don't send DTMF END from previous event, send it now */ - ast_sched_del(sched, pvt->DTMFsched); - pvt->DTMFsched = -1; + AST_SCHED_DEL(sched, pvt->DTMFsched); f.subclass = pvt->curDTMF; f.samples = f.len = 0; ast_queue_frame(pvt->owner, &f); |