endpoints: Keep a reference to channel ids when creating snapshot.

The snapshot process for endpoints uses the channel ids present
on the endpoint itself. Without keeping a reference it was possible
for the strings to be freed underneath any consumer of an endpoint
snapshot.

A reference is now held by the snapshot to the channel ids and
released when the snapshot is destroyed.

(issue ASTERISK-22801)
Reported by: Matt Jordan
........

Merged revisions 403542 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403543 65c4cc65-6c06-0410-ace0-fbb531ad65f3

main/endpoints.c

@@ -388,8 +388,14 @@ void ast_endpoint_set_max_channels(struct ast_endpoint *endpoint,
 static void endpoint_snapshot_dtor(void *obj)
 {
 	struct ast_endpoint_snapshot *snapshot = obj;
+	int channel;
 
 	ast_assert(snapshot != NULL);
+
+	for (channel = 0; channel < snapshot->num_channels; channel++) {
+		ao2_ref(snapshot->channel_ids[channel], -1);
+	}
+
 	ast_string_field_free_memory(snapshot);
 }
 
@@ -422,8 +428,8 @@ struct ast_endpoint_snapshot *ast_endpoint_snapshot_create(
 
 	i = ao2_iterator_init(endpoint->channel_ids, 0);
 	while ((obj = ao2_iterator_next(&i))) {
-		RAII_VAR(char *, channel_id, obj, ao2_cleanup);
-		snapshot->channel_ids[snapshot->num_channels++] = channel_id;
+		/* The reference is kept so the channel id does not go away until the snapshot is gone */
+		snapshot->channel_ids[snapshot->num_channels++] = obj;
 	}
 	ao2_iterator_destroy(&i);