From 6bf909cd2ef4ec454e144890a53fd27ffc6d5d4c Mon Sep 17 00:00:00 2001 From: Russell Bryant Date: Fri, 15 Feb 2008 23:31:39 +0000 Subject: [PATCH] Fix a crash in chan_iax2 due to a race condition (closes issue #11780) Reported by: guillecabeza Patches: bug_iax2_jb_1.4.patch uploaded by guillecabeza (license 380) bug_iax2_jb_trunk.patch uploaded by guillecabeza (license 380) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@103741 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_iax2.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 90ad719946..0f17c80b14 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -2515,7 +2515,9 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr int type, len; int ret; int needfree = 0; - + struct ast_channel *owner = NULL; + struct ast_channel *bridge = NULL; + /* Attempt to recover wrapped timestamps */ unwrap_timestamp(fr); @@ -2547,11 +2549,12 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr return -1; } + if ((owner = iaxs[fr->callno]->owner)) + bridge = ast_bridged_channel(owner); + /* if the user hasn't requested we force the use of the jitterbuffer, and we're bridged to * a channel that can accept jitter, then flush and suspend the jb, and send this frame straight through */ - if( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) && - iaxs[fr->callno]->owner && ast_bridged_channel(iaxs[fr->callno]->owner) && - (ast_bridged_channel(iaxs[fr->callno]->owner)->tech->properties & AST_CHAN_TP_WANTSJITTER)) { + if ( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) && owner && bridge && (bridge->tech->properties & AST_CHAN_TP_WANTSJITTER) ) { jb_frame frame; /* deliver any frames in the jb */