crash on transfer

handle_invite_replaces() attempts to uplock a pvt's
owner channel without first verifing that it exists.

(issue #16027)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@222542 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 86dcad9e5fa9e3cd3d096c9141ab651af923c209..b77876794d289ac8b09d36155d70aa65958234d2 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -14229,7 +14229,10 @@ static int handle_invite_replaces(struct sip_pvt *p, struct sip_request *req, in
                        can't harm */
                transmit_response_with_sdp(p, "200 OK", req, XMIT_RELIABLE);
                /* Do something more clever here */
-               ast_channel_unlock(c);
+               if (c) {
+                       *nounlock = 1;
+                       ast_channel_unlock(c);
+               }
                ast_channel_unlock(replacecall);
                ast_mutex_unlock(&p->refer->refer_call->lock);
                return 1;