FS-10472: [mod_conference] Crash due to hangup race in conference personal canvas...

diff --git a/src/mod/applications/mod_conference/conference_video.c b/src/mod/applications/mod_conference/conference_video.c
index 70a15ee78998ee49c6eda1bd46de8163a44a1829..aa3e5e31bb8c5736b841e150a6a8542449dfcec5 100644 (file)
--- a/src/mod/applications/mod_conference/conference_video.c
+++ b/src/mod/applications/mod_conference/conference_video.c
@@ -1050,7 +1050,6 @@ void conference_video_init_canvas_layers(conference_obj_t *conference, mcu_canva
 
        switch_thread_rwlock_wrlock(canvas->video_rwlock);
        switch_mutex_lock(canvas->mutex);
-       canvas->layout_floor_id = -1;
 
        for (i = 0; i < MCU_MAX_LAYERS; i++) {
                mcu_layer_t *layer = &canvas->layers[i];
@@ -1070,6 +1069,8 @@ void conference_video_init_canvas_layers(conference_obj_t *conference, mcu_canva
                return;
        }
 
+       canvas->layout_floor_id = -1;
+
        if (!vlayout) {
                switch_mutex_unlock(canvas->mutex);
                switch_thread_rwlock_unlock(canvas->video_rwlock);
@@ -3057,12 +3058,18 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr
 
                                for (j = 0; j < file_count; j++) {
                                        switch_image_t *img = file_imgs[j];
+                                       layer = NULL;
 
                                        if (j == 0 && imember->canvas->layout_floor_id > -1) {
                                                layer = &imember->canvas->layers[imember->canvas->layout_floor_id];
-                                               conference_video_scale_and_patch(layer, img, SWITCH_FALSE);
                                        } else if (i < imember->canvas->total_layers) {
                                                layer = &imember->canvas->layers[i++];
+                                       }
+
+                                       if (layer) {
+                                               switch_img_free(&layer->banner_img);
+                                               switch_img_free(&layer->logo_img);
+                                               layer->member_id = -1;
                                                conference_video_scale_and_patch(layer, img, SWITCH_FALSE);
                                        }
                                }