bridge: avoid leaking channel during blond transfer pt2

A blond transfer to a failed destination, when followed
by a recall attempt, lead to a leak of the reference to
the destination channel.  In addition to correcting the
regression on the previous attempt (r429826) this fixes
the leak and two additional reference leaks on failures
of bridge_import.

ASTERISK-24513 #close
Review: https://reviewboard.asterisk.org/r/4302/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@430199 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/bridge_basic.c b/main/bridge_basic.c
index 772b0a90c1b889eb082a829111dc5279f7e99169..47527f370d955554283034715f1b0e6f812f19a8 100644 (file)
--- a/main/bridge_basic.c
+++ b/main/bridge_basic.c
@@ -1319,7 +1319,10 @@ struct attended_transfer_properties {
        struct ast_channel *transfer_target;
        /*! The party that is currently being recalled. Depending on
         * the current state, this may be either the party that originally
-        * was the transferer or the original transfer target
+        * was the transferer or the original transfer target.  This is
+        * set with reference when entering the BLOND_NONFINAL, RECALLING,
+        * and RETRANSFER states, and the reference released on state exit
+        * if continuing with recall or retransfer to avoid leak.
         */
        struct ast_channel *recall_target;
        /*! The absolute starting time for running timers */
@@ -2259,10 +2262,10 @@ static int blond_nonfinal_enter(struct attended_transfer_properties *props)
 {
        int res;
        props->superstate = SUPERSTATE_RECALL;
+       /* move the transfer target to the recall target along with its reference */
        props->recall_target = ast_channel_ref(props->transfer_target);
        res = blond_enter(props);
-       /* transfer properties holds a separate reference to transfer_target, don't set it to NULL here */
-       ast_channel_unref(props->transfer_target);
+       props->transfer_target = ast_channel_unref(props->transfer_target);
        return res;
 }
 
@@ -2276,8 +2279,8 @@ static enum attended_transfer_state blond_nonfinal_exit(struct attended_transfer
                return TRANSFER_RESUME;
        case STIMULUS_TIMEOUT:
                ast_softhangup(props->recall_target, AST_SOFTHANGUP_EXPLICIT);
-               props->recall_target = ast_channel_unref(props->recall_target);
        case STIMULUS_RECALL_TARGET_HANGUP:
+               props->recall_target = ast_channel_unref(props->recall_target);
                return TRANSFER_RECALLING;
        case STIMULUS_NONE:
        case STIMULUS_DTMF_ATXFER_ABORT:
@@ -2406,6 +2409,7 @@ static enum attended_transfer_state recalling_exit(struct attended_transfer_prop
                if (ast_bridge_impart(props->transferee_bridge, props->recall_target, NULL, NULL,
                        AST_BRIDGE_IMPART_CHAN_INDEPENDENT)) {
                        ast_hangup(props->recall_target);
+                       ast_channel_unref(props->recall_target);
                        return TRANSFER_FAIL;
                }
                return TRANSFER_RESUME;
@@ -2499,6 +2503,7 @@ static int retransfer_enter(struct attended_transfer_properties *props)
                AST_BRIDGE_IMPART_CHAN_INDEPENDENT)) {
                ast_log(LOG_ERROR, "Unable to place recall target into bridge\n");
                ast_hangup(props->recall_target);
+               ast_channel_unref(props->recall_target);
                return -1;
        }