From e7f7c8c9de3dc382bf22afd9607fb6fb6f581069 Mon Sep 17 00:00:00 2001
From: "Joshua C. Colp" <jcolp@sangoma.com>
Date: Sun, 31 May 2020 19:10:29 -0300
Subject: [PATCH] res_rtp_asterisk: Re-order RTP destruction.

The destructor for RTP deallocated transport resources
before terminating the ICE support. This could result
in a crash as the thread handling ICE would access already
freed parts of the RTP data.

This change re-orders the destruction so that ICE is
stopped before destroying things.

ASTERISK-28885

Change-Id: Ie71add549f12b6cdea7e9dbf976d1bd1d2fc0bdc
---
 res/res_rtp_asterisk.c | 66 +++++++++++++++++++++---------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 8e1fb37c24..167a766912 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3429,39 +3429,6 @@ static int ast_rtp_destroy(struct ast_rtp_instance *instance)
 	ast_rtp_dtls_stop(instance);
 #endif
 
-	/* Destroy the smoother that was smoothing out audio if present */
-	if (rtp->smoother) {
-		ast_smoother_free(rtp->smoother);
-	}
-
-	/* Close our own socket so we no longer get packets */
-	if (rtp->s > -1) {
-		close(rtp->s);
-	}
-
-	/* Destroy RTCP if it was being used */
-	if (rtp->rtcp) {
-		/*
-		 * It is not possible for there to be an active RTCP scheduler
-		 * entry at this point since it holds a reference to the
-		 * RTP instance while it's active.
-		 */
-		if (rtp->rtcp->s > -1 && rtp->s != rtp->rtcp->s) {
-			close(rtp->rtcp->s);
-		}
-		ast_free(rtp->rtcp->local_addr_str);
-		ast_free(rtp->rtcp);
-	}
-
-	/* Destroy RED if it was being used */
-	if (rtp->red) {
-		ao2_unlock(instance);
-		AST_SCHED_DEL(rtp->sched, rtp->red->schedid);
-		ao2_lock(instance);
-		ast_free(rtp->red);
-		rtp->red = NULL;
-	}
-
 #ifdef HAVE_PJPROJECT
 	pj_thread_register_check();
 
@@ -3519,6 +3486,39 @@ static int ast_rtp_destroy(struct ast_rtp_instance *instance)
 	}
 #endif
 
+	/* Destroy the smoother that was smoothing out audio if present */
+	if (rtp->smoother) {
+		ast_smoother_free(rtp->smoother);
+	}
+
+	/* Close our own socket so we no longer get packets */
+	if (rtp->s > -1) {
+		close(rtp->s);
+	}
+
+	/* Destroy RTCP if it was being used */
+	if (rtp->rtcp) {
+		/*
+		 * It is not possible for there to be an active RTCP scheduler
+		 * entry at this point since it holds a reference to the
+		 * RTP instance while it's active.
+		 */
+		if (rtp->rtcp->s > -1 && rtp->s != rtp->rtcp->s) {
+			close(rtp->rtcp->s);
+		}
+		ast_free(rtp->rtcp->local_addr_str);
+		ast_free(rtp->rtcp);
+	}
+
+	/* Destroy RED if it was being used */
+	if (rtp->red) {
+		ao2_unlock(instance);
+		AST_SCHED_DEL(rtp->sched, rtp->red->schedid);
+		ao2_lock(instance);
+		ast_free(rtp->red);
+		rtp->red = NULL;
+	}
+
 	ao2_cleanup(rtp->lasttxformat);
 	ao2_cleanup(rtp->lastrxformat);
 	ao2_cleanup(rtp->f.subclass.format);