diff options
| -rw-r--r-- | channels/chan_sip.c | 15 | ||||
| -rw-r--r-- | main/translate.c | 5 |
2 files changed, 15 insertions, 5 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 9480b4366..dce4f799d 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -2478,11 +2478,18 @@ static void sip_destroy_peer(struct sip_peer *peer) ast_variables_destroy(peer->chanvars); peer->chanvars = NULL; } - if (peer->expire > -1) - ast_sched_del(sched, peer->expire); - if (peer->pokeexpire > -1) - ast_sched_del(sched, peer->pokeexpire); + /* If the schedule delete fails, that means the schedule is currently + * running, which means we should wait for that thread to complete. + * Otherwise, there's a crashable race condition. + * + * NOTE: once peer is refcounted, this probably is no longer necessary. + */ + while (peer->expire > -1 && ast_sched_del(sched, peer->expire)) + usleep(1); + while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire)) + usleep(1); + register_peer_exten(peer, FALSE); ast_free_ha(peer->ha); if (ast_test_flag(&peer->flags[1], SIP_PAGE2_SELFDESTRUCT)) diff --git a/main/translate.c b/main/translate.c index e01ce9321..cc898a5db 100644 --- a/main/translate.c +++ b/main/translate.c @@ -232,7 +232,10 @@ struct ast_frame *ast_trans_frameout(struct ast_trans_pvt *pvt, f->offset = AST_FRIENDLY_OFFSET; f->src = pvt->t->name; f->data = pvt->outbuf; - return f; + /* We must clone the frame, because the pvt could disappear + * the moment after we return (and unlock the source channel). + */ + return ast_frisolate(f); } static struct ast_frame *default_frameout(struct ast_trans_pvt *pvt) |