From 0fe83cad51b030cd70193ebd31343c1899ae21ac Mon Sep 17 00:00:00 2001 From: Matt Jordan Date: Tue, 6 Oct 2015 20:43:58 -0500 Subject: [PATCH] res/res_rtp_asterisk: Fix assignment after ao2 decrement When we decide we will no longer schedule an RTCP write, we remove the reference to the RTP instance, then assign -1 to the stored scheduler ID in case something else comes along and wants to see if anything is scheduled. That scheduler ID is on the RTP instance. After 60a9172d7ef2 was merged to fix the regression introduced by 3cf0f29310, this improper assignment on a potentially destroyed object started getting tripped on the build agents. Frankly, this should have been crashing a lot more often earlier. I can only assume that the timing was changed just enough by both changes to start actually hitting this problem. As it is, simply moving the assignment prior to the ao2 deference is sufficient to keep the RTP instance from being referenced when it is very, truly, aboslutely dead. (Note that it is still good practice to assign -1 to the scheduler ID when we know we won't be scheduling it again, as the ao2 deref *may* not always destroy the ao2 object.) ASTERISK-25449 Change-Id: Ie6d3cb4adc7b1a6c078b1c38c19fc84cf787cda7 --- res/res_rtp_asterisk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c index f3f6b4b280..678926d5d7 100644 --- a/res/res_rtp_asterisk.c +++ b/res/res_rtp_asterisk.c @@ -3117,8 +3117,8 @@ static int ast_rtcp_write(const void *data) /* * Not being rescheduled. */ - ao2_ref(instance, -1); rtp->rtcp->schedid = -1; + ao2_ref(instance, -1); } return res;