ast_framehook_detach() must be called with the channel locked.
authorRichard Mudgett <rmudgett@digium.com>
Tue, 23 Aug 2016 15:42:08 +0000 (10:42 -0500)
committerRichard Mudgett <rmudgett@digium.com>
Thu, 25 Aug 2016 22:11:50 +0000 (17:11 -0500)
The framehook container could become corrupted if the channel lock is not
held before calling.

Change-Id: If0a1c7ba0484ed3a191106a7516526b905952584

res/res_fax.c
res/res_pjsip_refer.c

index c301aff..b6fefe2 100644 (file)
@@ -4509,7 +4509,9 @@ static int acf_faxopt_write(struct ast_channel *chan, const char *cmd, char *dat
                                ast_log(LOG_WARNING, "Attempt to attach a T.38 gateway on channel (%s) with gateway already running.\n", ast_channel_name(chan));
                        }
                } else if (ast_false(val)) {
+                       ast_channel_lock(chan);
                        ast_framehook_detach(chan, details->gateway_id);
+                       ast_channel_unlock(chan);
                        details->gateway_id = -1;
                } else {
                        ast_log(LOG_WARNING, "Unsupported value '%s' passed to FAXOPT(%s).\n", value, data);
@@ -4561,7 +4563,9 @@ static int acf_faxopt_write(struct ast_channel *chan, const char *cmd, char *dat
                                ast_log(LOG_WARNING, "Attempt to attach a FAX detect on channel (%s) with FAX detect already running.\n", ast_channel_name(chan));
                        }
                } else if (ast_false(val)) {
+                       ast_channel_lock(chan);
                        ast_framehook_detach(chan, details->faxdetect_id);
+                       ast_channel_unlock(chan);
                        details->faxdetect_id = -1;
                } else {
                        ast_log(LOG_WARNING, "Unsupported value '%s' passed to FAXOPT(%s).\n", value, data);
index 78d6e23..19367bf 100644 (file)
@@ -641,7 +641,9 @@ static void refer_blind_callback(struct ast_channel *chan, struct transfer_chann
                                refer_progress_notify(notification);
                        }
 
+                       ast_channel_lock(chan);
                        ast_framehook_detach(chan, refer->progress->framehook);
+                       ast_channel_unlock(chan);
 
                        ao2_cleanup(refer->progress);
                }