Merged revisions 98943 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r98943 | russell | 2008-01-15 17:26:52 -0600 (Tue, 15 Jan 2008) | 25 lines

Commit a fix for some memory access errors pointed out by the valgrind2.txt
output on issue #11698.

The issue here is that it is possible for an instance of a translator to get
destroyed while the frame allocated as a part of the translator is still being
processed.  Specifically, this is possible anywhere between a call to ast_read()
and ast_frame_free(), which is _a lot_ of places in the code.  The reason this
happens is that the channel might get masqueraded during this time.  During a
masquerade, existing translation paths get destroyed.

So, this patch fixes the issue in an API and ABI compatible way.  (This one is
 for you, paravoid!)

It changes an int in ast_frame to be used as flag bits.  The 1 bit is still used
to indicate that the frame contains timing information.  Also, a second flag has
been added to indicate that the frame came from a translator.  When a frame with
this flag gets released and has this flag, a function is called in translate.c to
let it know that this frame is doing being processed.  At this point, the flag gets
cleared.  Also, if the translator was requested to be destroyed while its internal
frame still had this flag set, its destruction has been deffered until it finds out
that the frame is no longer being processed.

Admittedly, this feels like a hack.  But, it does fix the issue, and I was not able 
to think of a better solution ...

........


git-svn-id: http://svn.digium.com/svn/asterisk/trunk@98944 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 22 insertions, 1 deletions

diff --git a/include/asterisk/translate.h b/include/asterisk/translate.h
index 48b5bf091..b1f615f7f 100644
--- a/include/asterisk/translate.h
+++ b/include/asterisk/translate.h
@@ -138,7 +138,14 @@ struct ast_trans_pvt {
 	struct ast_translator *t;
 	struct ast_frame f;	/*!< used in frameout */
 	int samples;		/*!< samples available in outbuf */
-	int datalen;		/*!< actual space used in outbuf */
+	/*! 
+	 * \brief actual space used in outbuf
+	 *
+	 * Also, for the sake of ABI compatability, a magic value of -1 in this
+	 * field means that the pvt has been requested to be destroyed, but is
+	 * pending destruction until ast_translate_frame_freed() gets called. 
+	 */
+	int datalen;
 	void *pvt;		/*!< more private data, if any */
 	char *outbuf;		/*!< the useful portion of the buffer */
 	plc_state_t *plc;	/*!< optional plc pointer */
@@ -250,6 +257,20 @@ unsigned int ast_translate_path_steps(unsigned int dest, unsigned int src);
  */
 unsigned int ast_translate_available_formats(unsigned int dest, unsigned int src);
 
+/*!
+ * \brief Hint that a frame from a translator has been freed
+ *
+ * This is sort of a hack.  This function gets called when ast_frame_free() gets
+ * called on a frame that has the AST_FRFLAG_FROM_TRANSLATOR flag set.  This is
+ * because it is possible for a translation path to be destroyed while a frame
+ * from a translator is still in use.  Specifically, this happens if a masquerade
+ * happens after a call to ast_read() but before the frame is done being processed, 
+ * since the frame processing is generally done without the channel lock held.
+ *
+ * \return nothing
+ */
+void ast_translate_frame_freed(struct ast_frame *fr);
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif