Merged revisions 304729 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.6.2

........
  r304729 | seanbright | 2011-01-29 12:01:51 -0500 (Sat, 29 Jan 2011) | 15 lines
  
  Make sure that we unref the correct object when ejecting the most recent caller.
  
  Currently, when we kick the last user to enter, we decrement our own reference
  count which results in a crash when we kick another user or when we exit the
  conference ourselves.
  
  This will fix #18225 in 1.8 and trunk, but that particular bug does not exist in
  1.6.2.
  
  (closes issue #18225)
  Reported by: kenji
  Patches:
        issue18225.patch uploaded by seanbright (license 71)
  Tested by: seanbright
........


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@304730 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_meetme.c

@@ -2188,7 +2188,6 @@ static int user_set_muted_cb(void *obj, void *check_admin_arg, int flags)
 static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struct ast_flags64 *confflags, char *optargs[])
 {
 	struct ast_conf_user *user = NULL;
-	struct ast_conf_user *usr = NULL;
 	int fd;
 	struct dahdi_confinfo dahdic, dahdic_empty;
 	struct ast_frame *f;
@@ -3172,6 +3171,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 							int keepplaying;
 							int playednamerec;
 							struct ao2_iterator user_iter;
+							struct ast_conf_user *usr = NULL;
 							switch(dtmf) {
 							case '1': /* *81 Roll call */
 								keepplaying = 1;
@@ -3210,7 +3210,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 									}
 								}
 								user_iter = ao2_iterator_init(conf->usercontainer, 0);
-								while((user = ao2_iterator_next(&user_iter))) {
+								while((usr = ao2_iterator_next(&user_iter))) {
 									if (ast_fileexists(usr->namerecloc, NULL, NULL)) {
 										if (keepplaying && !ast_streamfile(chan, usr->namerecloc, chan->language)) {
 											res = ast_waitstream(chan, AST_DIGIT_ANY);
@@ -3220,7 +3220,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 										}
 										playednamerec = 1;
 									}
-									ao2_ref(user, -1);
+									ao2_ref(usr, -1);
 								}
 								ao2_iterator_destroy(&user_iter);
 								if (keepplaying && playednamerec && !ast_streamfile(chan, "conf-roll-callcomplete", chan->language)) {
@@ -3364,6 +3364,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 								break;
 							case '3': /* Eject last user */
 							{
+								struct ast_conf_user *usr = NULL;
 								int max_no = 0;
 								ao2_callback(conf->usercontainer, OBJ_NODATA, user_max_cmp, &max_no);
 								menu_active = 0;
@@ -3375,7 +3376,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 								} else {
 									usr->adminflags |= ADMINFLAG_KICKME;
 								}
-								ao2_ref(user, -1);
+								ao2_ref(usr, -1);
 								ast_stopstream(chan);
 								break;	
 							}