endpoints: Keep a reference to channel ids when creating snapshot.

The snapshot process for endpoints uses the channel ids present
on the endpoint itself. Without keeping a reference it was possible
for the strings to be freed underneath any consumer of an endpoint
snapshot.

A reference is now held by the snapshot to the channel ids and
released when the snapshot is destroyed.

(issue ASTERISK-22801)
Reported by: Matt Jordan
........

Merged revisions 403542 from http://svn.asterisk.org/svn/asterisk/branches/12

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403543 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/endpoints.c b/main/endpoints.c
index 9eeadfeef8774764f76e092e6e097989ce5a530c..4be4eb31b60145424c95774560e302a1f3a3cfd5 100644 (file)
--- a/main/endpoints.c
+++ b/main/endpoints.c
@@ -388,8 +388,14 @@ void ast_endpoint_set_max_channels(struct ast_endpoint *endpoint,
 static void endpoint_snapshot_dtor(void *obj)
 {
        struct ast_endpoint_snapshot *snapshot = obj;
+       int channel;
 
        ast_assert(snapshot != NULL);
+
+       for (channel = 0; channel < snapshot->num_channels; channel++) {
+               ao2_ref(snapshot->channel_ids[channel], -1);
+       }
+
        ast_string_field_free_memory(snapshot);
 }
 
@@ -422,8 +428,8 @@ struct ast_endpoint_snapshot *ast_endpoint_snapshot_create(
 
        i = ao2_iterator_init(endpoint->channel_ids, 0);
        while ((obj = ao2_iterator_next(&i))) {
-               RAII_VAR(char *, channel_id, obj, ao2_cleanup);
-               snapshot->channel_ids[snapshot->num_channels++] = channel_id;
+               /* The reference is kept so the channel id does not go away until the snapshot is gone */
+               snapshot->channel_ids[snapshot->num_channels++] = obj;
        }
        ao2_iterator_destroy(&i);