We have some bug reports showing crashes due to a double free of a channel.

Add a sanity check to ast_channel_free() to make sure we don't go on trying
to free a channel that wasn't found in the channel list.
(issue #8850, and others...)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@67715 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channel.c b/channel.c
index 4c71ce3f62b8c2184cf6905011cb174e1840bb13..5a520db43f677827eba9591e9a79eda4ee73dcf1 100644 (file)
--- a/channel.c
+++ b/channel.c
@@ -897,14 +897,16 @@ void ast_channel_free(struct ast_channel *chan)
                last = cur;
                cur = cur->next;
        }
-       if (!cur)
-               ast_log(LOG_WARNING, "Unable to find channel in list\n");
-       else {
-               /* Lock and unlock the channel just to be sure nobody
-                  has it locked still */
-               ast_mutex_lock(&cur->lock);
-               ast_mutex_unlock(&cur->lock);
+       if (!cur) {
+               ast_mutex_unlock(&chlock);
+               ast_log(LOG_ERROR, "Unable to find channel in list to free. Assuming it has already been done.\n");
+               return;
        }
+
+       /* Lock and unlock the channel just to be sure nobody
+          has it locked still */
+       ast_mutex_lock(&cur->lock);
+       ast_mutex_unlock(&cur->lock);
        if (chan->tech_pvt) {
                ast_log(LOG_WARNING, "Channel '%s' may not have been hung up properly\n", chan->name);
                free(chan->tech_pvt);