From 67ea0c207879865ad9fe9b2b28e1a645ccf586b1 Mon Sep 17 00:00:00 2001 From: Joshua Colp Date: Mon, 9 Dec 2013 18:31:13 +0000 Subject: [PATCH] endpoints: Keep a reference to channel ids when creating snapshot. The snapshot process for endpoints uses the channel ids present on the endpoint itself. Without keeping a reference it was possible for the strings to be freed underneath any consumer of an endpoint snapshot. A reference is now held by the snapshot to the channel ids and released when the snapshot is destroyed. (issue ASTERISK-22801) Reported by: Matt Jordan git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@403542 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- main/endpoints.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/main/endpoints.c b/main/endpoints.c index 9eeadfeef8..4be4eb31b6 100644 --- a/main/endpoints.c +++ b/main/endpoints.c @@ -388,8 +388,14 @@ void ast_endpoint_set_max_channels(struct ast_endpoint *endpoint, static void endpoint_snapshot_dtor(void *obj) { struct ast_endpoint_snapshot *snapshot = obj; + int channel; ast_assert(snapshot != NULL); + + for (channel = 0; channel < snapshot->num_channels; channel++) { + ao2_ref(snapshot->channel_ids[channel], -1); + } + ast_string_field_free_memory(snapshot); } @@ -422,8 +428,8 @@ struct ast_endpoint_snapshot *ast_endpoint_snapshot_create( i = ao2_iterator_init(endpoint->channel_ids, 0); while ((obj = ao2_iterator_next(&i))) { - RAII_VAR(char *, channel_id, obj, ao2_cleanup); - snapshot->channel_ids[snapshot->num_channels++] = channel_id; + /* The reference is kept so the channel id does not go away until the snapshot is gone */ + snapshot->channel_ids[snapshot->num_channels++] = obj; } ao2_iterator_destroy(&i);