From 2d95fb33bd741f27d99f97dbc4777b1f8c0bee6f Mon Sep 17 00:00:00 2001
From: Russell Bryant <russell@russellbryant.com>
Date: Mon, 10 Mar 2008 20:05:12 +0000
Subject: [PATCH] Merged revisions 107158 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r107158 | russell | 2008-03-10 15:04:27 -0500 (Mon, 10 Mar 2008) | 9 lines

Fix some bugs related to originating calls.  If the code failed to start a PBX
on the channel (such as if you set a call limit based on the system's load
average), then there were cases where a channel that has already been free'd
using ast_hangup() got accessed.  This caused weird memory corruption and
crashes to occur.

(fixes issue BE-386)
(much debugging credit goes to twilson, final patch written by me)

........


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@107159 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 main/pbx.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/main/pbx.c b/main/pbx.c
index 427c0cca95..9050c55fa0 100644
--- a/main/pbx.c
+++ b/main/pbx.c
@@ -6534,6 +6534,7 @@ int ast_pbx_outgoing_exten(const char *type, int format, void *data, int timeout
 						if (channel)
 							*channel = NULL;
 						ast_hangup(chan);
+						chan = NULL;
 						res = -1;
 					}
 				} else {
@@ -6544,6 +6545,7 @@ int ast_pbx_outgoing_exten(const char *type, int format, void *data, int timeout
 							ast_channel_unlock(chan);
 						}
 						ast_hangup(chan);
+						chan = NULL;
 						res = -1;
 					}
 				}
@@ -6562,6 +6564,7 @@ int ast_pbx_outgoing_exten(const char *type, int format, void *data, int timeout
 					ast_channel_unlock(chan);
 				}
 				ast_hangup(chan);
+				chan = NULL;
 			}
 		}
 
@@ -6589,7 +6592,11 @@ int ast_pbx_outgoing_exten(const char *type, int format, void *data, int timeout
 					pbx_builtin_setvar_helper(chan, "REASON", failed_reason);
 					if (account)
 						ast_cdr_setaccount(chan, account);
-					ast_pbx_run(chan);
+					if (ast_pbx_run(chan)) {
+						ast_log(LOG_ERROR, "Unable to run PBX on %s\n", chan->name);
+						ast_hangup(chan);
+					}
+					chan = NULL;
 				}
 			}
 		}
-- 
GitLab