From ecef8fb208b8cdd99cb228d9fcab7f73aeec4b8d Mon Sep 17 00:00:00 2001 From: aabolfazl Date: Sun, 2 Aug 2026 19:49:37 +0300 Subject: [PATCH] res_musiconhold: Fix mohclass reference leak on answeredonly early return. local_ast_moh_start() returns -1 from the answeredonly check without releasing the mohclass reference it holds, unlike every other exit path in the function. Nothing else ever releases that reference, so moh_class_destructor() never runs for the object. With realtime music on hold and cachertclasses disabled, each suppressed request leaks the class object, its monitor thread, the external application process and two file descriptors for the lifetime of Asterisk. For static classes the stale references prevent the class from ever being destroyed after it is replaced by a reload. Release the reference before returning, matching the other exit paths. Fixes: #2051 --- res/res_musiconhold.c | 1 + 1 file changed, 1 insertion(+) diff --git a/res/res_musiconhold.c b/res/res_musiconhold.c index 3d494dfe38..e0ebb40ec2 100644 --- a/res/res_musiconhold.c +++ b/res/res_musiconhold.c @@ -1931,6 +1931,7 @@ static int local_ast_moh_start(struct ast_channel *chan, const char *mclass, con if (mohclass->answeredonly && (ast_channel_state(chan) != AST_STATE_UP)) { ast_verb(3, "The channel '%s' is not answered yet. Ignore the moh request.\n", ast_channel_name(chan)); + mohclass = mohclass_unref(mohclass, "unreffing local reference to mohclass (channel not answered)"); return -1; }