From: phoneben <3232963@gmail.com>
Date: Wed, 26 Nov 2025 12:00:21 +0000 (+0200)
Subject: channelstorage_cpp: Fix fallback return value in channelstorage callback
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=065c507ffcc27995096a5e8bcd8731a92bb9bc25;p=thirdparty%2Fasterisk.git

channelstorage_cpp: Fix fallback return value in channelstorage callback

callback returned the last iterated channel when no match existed, causing invalid channel references and potential double frees. Updated to correctly return NULL when there is no match.

Resolves: #1609
---

diff --git a/main/channelstorage_cpp_map_name_id.cc b/main/channelstorage_cpp_map_name_id.cc
index d4b42f3bf5..dfbfbb9a92 100644
--- a/main/channelstorage_cpp_map_name_id.cc
+++ b/main/channelstorage_cpp_map_name_id.cc
@@ -172,9 +172,8 @@ static struct ast_channel *callback(struct ast_channelstorage_instance *driver,
 		rdlock(driver);
 	}
 	for (it = getdb(driver).begin(); it != getdb(driver).end(); it++) {
-		chan = it->second;
-		if (cb_fn(chan, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
-			ao2_bump(chan);
+		if (cb_fn(it->second, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
+			chan = ao2_bump(it->second);
 			break;
 		}
 	}