From 182531cfdd3e69592f9be92f14971fca386bb5aa Mon Sep 17 00:00:00 2001
From: phoneben <3232963@gmail.com>
Date: Wed, 26 Nov 2025 14:00:21 +0200
Subject: [PATCH] channelstorage_cpp: Fix fallback return value in
 channelstorage callback

callback returned the last iterated channel when no match existed, causing invalid channel references and potential double frees. Updated to correctly return NULL when there is no match.

Resolves: #1609
---
 main/channelstorage_cpp_map_name_id.cc | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/main/channelstorage_cpp_map_name_id.cc b/main/channelstorage_cpp_map_name_id.cc
index d4b42f3bf5..dfbfbb9a92 100644
--- a/main/channelstorage_cpp_map_name_id.cc
+++ b/main/channelstorage_cpp_map_name_id.cc
@@ -172,9 +172,8 @@ static struct ast_channel *callback(struct ast_channelstorage_instance *driver,
 		rdlock(driver);
 	}
 	for (it = getdb(driver).begin(); it != getdb(driver).end(); it++) {
-		chan = it->second;
-		if (cb_fn(chan, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
-			ao2_bump(chan);
+		if (cb_fn(it->second, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
+			chan = ao2_bump(it->second);
 			break;
 		}
 	}