FS-10757: [mod_conference] Race condition freeing avatar image #resolve

diff --git a/src/mod/applications/mod_conference/conference_loop.c b/src/mod/applications/mod_conference/conference_loop.c
index f23491af8561695f6bf60eed9bc3134212560ed5..6f162d247f32fa57167ba9d77b8e2c2ed376542e 100644 (file)
--- a/src/mod/applications/mod_conference/conference_loop.c
+++ b/src/mod/applications/mod_conference/conference_loop.c
@@ -832,7 +832,9 @@ void *SWITCH_THREAD_FUNC conference_loop_input(switch_thread_t *thread, void *ob
 
                if (switch_channel_test_flag(channel, CF_VIDEO) && !conference_utils_member_test_flag(member, MFLAG_ACK_VIDEO)) {
                        conference_utils_member_set_flag_locked(member, MFLAG_ACK_VIDEO);
+                       switch_mutex_lock(member->flag_mutex);
                        switch_img_free(&member->avatar_png_img);
+                       switch_mutex_unlock(member->flag_mutex);
                        conference_video_check_avatar(member, SWITCH_FALSE);
                        switch_core_session_video_reinit(member->session);
                        conference_video_set_floor_holder(member->conference, member, SWITCH_FALSE);

diff --git a/src/mod/applications/mod_conference/conference_member.c b/src/mod/applications/mod_conference/conference_member.c
index ea80527ac89e3208231c8d04e9f6407dcbbe9d54..b9dc9888cdbd34ee2a5b02caa87d5bd8389ab5e7 100644 (file)
--- a/src/mod/applications/mod_conference/conference_member.c
+++ b/src/mod/applications/mod_conference/conference_member.c
@@ -1191,9 +1191,11 @@ switch_status_t conference_member_del(conference_obj_t *conference, conference_m
                last = imember;
        }
 
+       switch_mutex_lock(member->flag_mutex);
        switch_img_free(&member->avatar_png_img);
        switch_img_free(&member->video_mute_img);
        switch_img_free(&member->pcanvas_img);
+       switch_mutex_unlock(member->flag_mutex);
 
        switch_thread_rwlock_unlock(member->rwlock);
 

diff --git a/src/mod/applications/mod_conference/conference_video.c b/src/mod/applications/mod_conference/conference_video.c
index ba2b6566b8841459a2f2d2a6160fdacce4116d85..9479152ec8ab4f1fcc6da346a9eed18595cd26e2 100644 (file)
--- a/src/mod/applications/mod_conference/conference_video.c
+++ b/src/mod/applications/mod_conference/conference_video.c
@@ -2371,8 +2371,10 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo
                avatar = var;
        }
 
+       switch_mutex_lock(member->flag_mutex);
        switch_img_free(&member->avatar_png_img);
 
+
        if (avatar) {
                member->avatar_png_img = switch_img_read_png(avatar, SWITCH_IMG_FMT_I420);
        }
@@ -2385,6 +2387,8 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo
                member->auto_avatar = 1;
        }
 
+       switch_mutex_unlock(member->flag_mutex);
+
        if (canvas) {
                switch_mutex_unlock(canvas->mutex);
                conference_video_release_canvas(&canvas);
@@ -2404,7 +2408,9 @@ void conference_video_check_flush(conference_member_t *member, switch_bool_t for
        if ((flushed || force) && member->auto_avatar) {
                switch_channel_video_sync(member->channel);
 
+               switch_mutex_lock(member->flag_mutex);
                switch_img_free(&member->avatar_png_img);
+               switch_mutex_unlock(member->flag_mutex);
                member->avatar_patched = 0;
                conference_video_reset_video_bitrate_counters(member);
                member->blanks = 0;
@@ -3329,6 +3335,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr
                                }
                        }
 
+                       switch_mutex_lock(imember->flag_mutex);
                        if (imember->avatar_png_img) {
                                if (layer) {
                                        if (!imember->avatar_patched || !layer->cur_img) {
@@ -3342,6 +3349,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr
                                }
                                switch_img_free(&img);
                        }
+                       switch_mutex_unlock(imember->flag_mutex);
 
                        if (imember->video_layer_id < 0) {
                                layer = NULL;