fixes segfault when transferring a queue caller

In sip_hangup we attempted to lock p->owner after we set it to NULL.
Thanks to fhackenberger for reporting the issue and submitting a patch.

(closes issue 0015848)
Reported by: fhackenberger
Patches:
      digium_bug_0015848 uploaded by fhackenberger (license 592)
Tested by: fhackenberger, lmadsen, TomS, shin-shoryuken, dvossel

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@229014 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 0ea34dac34f2567ea95720c0e66784fe6eed6d9f..cdcab1985416b36d76a977c83126f3442ef7764a 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -5674,15 +5674,12 @@ static int sip_hangup(struct ast_channel *ast)
                                 * to lock the bridge. This may get hairy...
                                 */
                                while (bridge && ast_channel_trylock(bridge)) {
-                                       struct ast_channel *chan = p->owner;
                                        sip_pvt_unlock(p);
                                        do {
-                                               /* Use chan since p->owner could go NULL on us
-                                                * while p is unlocked
-                                                */
-                                               CHANNEL_DEADLOCK_AVOIDANCE(chan);
+                                               /* Use oldowner since p->owner is already NULL */
+                                               CHANNEL_DEADLOCK_AVOIDANCE(oldowner);
                                        } while (sip_pvt_trylock(p));
-                                       bridge = p->owner ? ast_bridged_channel(p->owner) : NULL;
+                                       bridge = ast_bridged_channel(oldowner);
                                }
 
                                if (p->rtp)