From db78ad3def11acaae2dc1b2c204a27a7923fd195 Mon Sep 17 00:00:00 2001 From: dvossel Date: Mon, 9 Nov 2009 22:17:31 +0000 Subject: fixes segfault when transferring a queue caller In sip_hangup we attempted to lock p->owner after we set it to NULL. Thanks to fhackenberger for reporting the issue and submitting a patch. (closes issue #15848) Reported by: fhackenberger Patches: digium_bug_0015848 uploaded by fhackenberger (license 592) Tested by: fhackenberger, lmadsen, TomS, shin-shoryuken, dvossel git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@229012 f38db490-d61c-443f-a65b-d21fe96a405b --- channels/chan_sip.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 0c5add6c8..2c107a420 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -6099,15 +6099,12 @@ static int sip_hangup(struct ast_channel *ast) * to lock the bridge. This may get hairy... */ while (bridge && ast_channel_trylock(bridge)) { - struct ast_channel *chan = p->owner; sip_pvt_unlock(p); do { - /* Use chan since p->owner could go NULL on us - * while p is unlocked - */ - CHANNEL_DEADLOCK_AVOIDANCE(chan); + /* Use oldowner since p->owner is already NULL */ + CHANNEL_DEADLOCK_AVOIDANCE(oldowner); } while (sip_pvt_trylock(p)); - bridge = p->owner ? ast_bridged_channel(p->owner) : NULL; + bridge = ast_bridged_channel(oldowner); } if (p->rtp) -- cgit v1.2.3