file.c: Increment the channel reference count when it is added as owner to a ast_filestream

SEGFAULTS and memory corruption has been reported at locations where the ast_filestream->owner is assumed to point to a vaild channel, sometimes it does not (and appears to have been freed).

Fixes: #829

UserNote: Ensure we increment the channel reference count when it is added as the owner of a ast_filestream and decrement it when the ast_filestream is destroyed

include/asterisk/file.h

@@ -356,7 +356,7 @@ struct ast_filestream *ast_openstream_full(struct ast_channel *chan, const char
 struct ast_filestream *ast_openvstream(struct ast_channel *chan, const char *filename, const char *preflang);
 
 /*!
- * \brief Applies a open stream to a channel.
+ * \brief Applies a open stream to a channel. And bumps the reference count of the channel.
  * \param chan channel to work
  * \param s ast_filestream to apply
  * \retval 0 on success.

main/file.c

@@ -449,6 +449,11 @@ static void filestream_destructor(void *arg)
 		}
 	}
 
+	/* Remove a reference to the owner channel if there is one from in ast_applystream */
+	if (f->owner)  {
+		f->owner = ast_channel_unref(f->owner);
+	}
+
 	ast_free(f->filename);
 	ast_free(f->realfilename);
 	if (f->vfs)
@@ -1064,7 +1069,19 @@ static int ast_fsread_video(const void *data)
 
 int ast_applystream(struct ast_channel *chan, struct ast_filestream *s)
 {
-	s->owner = chan;
+	/* If no changes don't do anything */
+	if (s->owner == chan) {
+		return 0;
+	}
+
+	/* Remove reference to any existing channel */
+	if (s->owner) {
+		ast_channel_unref(s->owner);
+	}
+
+	/* Bump the ref count so the channel doesn't go away */
+	s->owner = ast_channel_ref(chan);
+
 	return 0;
 }