res/res_rtp_asterisk: Fix assignment after ao2 decrement

When we decide we will no longer schedule an RTCP write, we remove the
reference to the RTP instance, then assign -1 to the stored scheduler ID
in case something else comes along and wants to see if anything is scheduled.

That scheduler ID is on the RTP instance. After 60a9172d7ef2 was merged to
fix the regression introduced by 3cf0f29310, this improper assignment on a
potentially destroyed object started getting tripped on the build agents.

Frankly, this should have been crashing a lot more often earlier. I can only
assume that the timing was changed just enough by both changes to start
actually hitting this problem.

As it is, simply moving the assignment prior to the ao2 deference is sufficient
to keep the RTP instance from being referenced when it is very, truly,
aboslutely dead.

(Note that it is still good practice to assign -1 to the scheduler ID when we
know we won't be scheduling it again, as the ao2 deref *may* not always destroy
the ao2 object.)

ASTERISK-25449

Change-Id: Ie6d3cb4adc7b1a6c078b1c38c19fc84cf787cda7

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index fb6a5be1b67467073f07b9dfc393735e0f206380..390fd085aff0c0fe7eb179924ba4f7117a6e7dd8 100644 (file)
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3199,8 +3199,8 @@ static int ast_rtcp_write(const void *data)
                /*
                 * Not being rescheduled.
                 */
-               ao2_ref(instance, -1);
                rtp->rtcp->schedid = -1;
+               ao2_ref(instance, -1);
        }
 
        return res;