On busy systems, it's possible for the values checked within a single line

of code to change, unless the structure is locked to ensure a consistent
state.
(closes issue #13717)
 Reported by: kowalma
 Patches: 
       20081102__bug13717.diff.txt uploaded by Corydon76 (license 14)
 Tested by: kowalma


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@154365 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_iax2.c

@@ -1558,12 +1558,21 @@ static int __find_callno(unsigned short callno, unsigned short dcallno, struct s
 
 		/* This will occur on the first response to a message that we initiated,
 		 * such as a PING. */
+		if (dcallno) {
+			ast_mutex_lock(&iaxsl[dcallno]);
+		}
 		if (callno && dcallno && iaxs[dcallno] && !iaxs[dcallno]->peercallno && match(sin, callno, dcallno, iaxs[dcallno], check_dcallno)) {
 			iaxs[dcallno]->peercallno = callno;
 			res = dcallno;
 			store_by_peercallno(iaxs[dcallno]);
+			if (!res || !return_locked) {
+				ast_mutex_unlock(&iaxsl[dcallno]);
+			}
 			return res;
 		}
+		if (dcallno) {
+			ast_mutex_unlock(&iaxsl[dcallno]);
+		}
 
 #ifdef IAX_OLD_FIND
 		/* If we get here, we SHOULD NOT find a call structure for this