diff options
| author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-27 21:59:53 +0000 |
|---|---|---|
| committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-01-27 21:59:53 +0000 |
| commit | 940f913146cc96cda9132600151d40ee85680ee6 (patch) | |
| tree | a0610b66a954f2b2f98aedcd42cbc2b4250184b8 /main/rtp.c | |
| parent | 74e414e5f2dbf490e4c2f67ce638e0ec9e4ad0ae (diff) | |
When deleting a task from the scheduler, ignoring the return value could
possibly cause memory to be accessed after it is freed, which causes all
sorts of random memory corruption. Instead, if a deletion fails, wait a
bit and try again (noting that another thread could change our taskid
value).
(closes issue #11386)
Reported by: flujan
Patches:
20080124__bug11386.diff.txt uploaded by Corydon76 (license 14)
Tested by: Corydon76, flujan, stuarth`
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@100465 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main/rtp.c')
| -rw-r--r-- | main/rtp.c | 24 |
1 files changed, 6 insertions, 18 deletions
diff --git a/main/rtp.c b/main/rtp.c index f35319fbe..949dd1cc8 100644 --- a/main/rtp.c +++ b/main/rtp.c @@ -2036,10 +2036,7 @@ struct ast_rtp *ast_rtp_get_bridged(struct ast_rtp *rtp) void ast_rtp_stop(struct ast_rtp *rtp) { - if (rtp->rtcp && rtp->rtcp->schedid > 0) { - ast_sched_del(rtp->sched, rtp->rtcp->schedid); - rtp->rtcp->schedid = -1; - } + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); memset(&rtp->them.sin_addr, 0, sizeof(rtp->them.sin_addr)); memset(&rtp->them.sin_port, 0, sizeof(rtp->them.sin_port)); @@ -2143,8 +2140,7 @@ void ast_rtp_destroy(struct ast_rtp *rtp) if (rtp->s > -1) close(rtp->s); if (rtp->rtcp) { - if (rtp->rtcp->schedid > 0) - ast_sched_del(rtp->sched, rtp->rtcp->schedid); + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); close(rtp->rtcp->s); free(rtp->rtcp); rtp->rtcp=NULL; @@ -2370,9 +2366,7 @@ static int ast_rtcp_write_sr(const void *data) if (!rtp->rtcp->them.sin_addr.s_addr) { /* This'll stop rtcp for this rtp session */ ast_verbose("RTCP SR transmission error, rtcp halted\n"); - if (rtp->rtcp->schedid > 0) - ast_sched_del(rtp->sched, rtp->rtcp->schedid); - rtp->rtcp->schedid = -1; + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); return 0; } @@ -2429,9 +2423,7 @@ static int ast_rtcp_write_sr(const void *data) res = sendto(rtp->rtcp->s, (unsigned int *)rtcpheader, len, 0, (struct sockaddr *)&rtp->rtcp->them, sizeof(rtp->rtcp->them)); if (res < 0) { ast_log(LOG_ERROR, "RTCP SR transmission error to %s:%d, rtcp halted %s\n",ast_inet_ntoa(rtp->rtcp->them.sin_addr), ntohs(rtp->rtcp->them.sin_port), strerror(errno)); - if (rtp->rtcp->schedid > 0) - ast_sched_del(rtp->sched, rtp->rtcp->schedid); - rtp->rtcp->schedid = -1; + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); return 0; } @@ -2481,9 +2473,7 @@ static int ast_rtcp_write_rr(const void *data) if (!rtp->rtcp->them.sin_addr.s_addr) { ast_log(LOG_ERROR, "RTCP RR transmission error, rtcp halted\n"); - if (rtp->rtcp->schedid > 0) - ast_sched_del(rtp->sched, rtp->rtcp->schedid); - rtp->rtcp->schedid = -1; + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); return 0; } @@ -2530,9 +2520,7 @@ static int ast_rtcp_write_rr(const void *data) if (res < 0) { ast_log(LOG_ERROR, "RTCP RR transmission error, rtcp halted: %s\n",strerror(errno)); /* Remove the scheduler */ - if (rtp->rtcp->schedid > 0) - ast_sched_del(rtp->sched, rtp->rtcp->schedid); - rtp->rtcp->schedid = -1; + AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid); return 0; } |