[Core] switch_channel_clear_state_handler(), switch_channel_get_state_handler():...

* [Core] switch_channel_clear_state_handler: Coverity 1546120 Data race condition

* [Core] Fix race in switch_channel_get_state_handler()

diff --git a/src/switch_channel.c b/src/switch_channel.c
index 9c7b8e433d153b97ee0c181d197049c0e029a723..66e18a323c20179fb41f5c9f977c3711bea607eb 100644 (file)
--- a/src/switch_channel.c
+++ b/src/switch_channel.c
@@ -3072,12 +3072,12 @@ SWITCH_DECLARE(const switch_state_handler_table_t *) switch_channel_get_state_ha
 
        switch_assert(channel != NULL);
 
-       if (index >= SWITCH_MAX_STATE_HANDLERS || index > channel->state_handler_index) {
-               return NULL;
+       switch_mutex_lock(channel->state_mutex);
+
+       if (index < SWITCH_MAX_STATE_HANDLERS && index <= channel->state_handler_index) {
+               h = channel->state_handlers[index];
        }
 
-       switch_mutex_lock(channel->state_mutex);
-       h = channel->state_handlers[index];
        switch_mutex_unlock(channel->state_mutex);
 
        return h;
@@ -3085,12 +3085,13 @@ SWITCH_DECLARE(const switch_state_handler_table_t *) switch_channel_get_state_ha
 
 SWITCH_DECLARE(void) switch_channel_clear_state_handler(switch_channel_t *channel, const switch_state_handler_table_t *state_handler)
 {
-       int index, i = channel->state_handler_index;
+       int index, i;
        const switch_state_handler_table_t *new_handlers[SWITCH_MAX_STATE_HANDLERS] = { 0 };
 
        switch_assert(channel != NULL);
 
        switch_mutex_lock(channel->state_mutex);
+       i = channel->state_handler_index;
        channel->state_handler_index = 0;
 
        if (state_handler) {