From c88f243d8d6ca80f98cd36fd6c0ff17529766af4 Mon Sep 17 00:00:00 2001 From: Tilghman Lesher <tilghman@meg.abyt.es> Date: Thu, 10 Jan 2008 23:40:13 +0000 Subject: [PATCH] Merged revisions 97973 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r97973 | tilghman | 2008-01-10 17:08:36 -0600 (Thu, 10 Jan 2008) | 6 lines 1) When we get a translated frame out, clone it, because if the translator pvt is freed before we use the frame, bad things happen. 2) Getting a failure from ast_sched_delete means that the schedule ID is currently running. Don't just ignore it. (Closes issue #11698) ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@97978 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 15 +++++++++++---- main/translate.c | 5 ++++- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 3d1b3158f8..10847f7b24 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -3044,11 +3044,18 @@ static void sip_destroy_peer(struct sip_peer *peer) ast_variables_destroy(peer->chanvars); peer->chanvars = NULL; } - if (peer->expire > -1) - ast_sched_del(sched, peer->expire); - if (peer->pokeexpire > -1) - ast_sched_del(sched, peer->pokeexpire); + /* If the schedule delete fails, that means the schedule is currently + * running, which means we should wait for that thread to complete. + * Otherwise, there's a crashable race condition. + * + * NOTE: once peer is refcounted, this probably is no longer necessary. + */ + while (peer->expire > -1 && ast_sched_del(sched, peer->expire)) + usleep(1); + while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire)) + usleep(1); + register_peer_exten(peer, FALSE); ast_free_ha(peer->ha); if (peer->selfdestruct) diff --git a/main/translate.c b/main/translate.c index 1236ee0ee4..1611385f50 100644 --- a/main/translate.c +++ b/main/translate.c @@ -225,7 +225,10 @@ struct ast_frame *ast_trans_frameout(struct ast_trans_pvt *pvt, f->offset = AST_FRIENDLY_OFFSET; f->src = pvt->t->name; f->data = pvt->outbuf; - return f; + /* We must clone the frame, because the pvt could disappear + * the moment after we return (and unlock the source channel). + */ + return ast_frisolate(f); } static struct ast_frame *default_frameout(struct ast_trans_pvt *pvt) -- GitLab