From: Joshua Colp <jcolp@digium.com>
Date: Fri, 13 Nov 2009 19:44:07 +0000 (+0000)
Subject: Fix a crash caused by two threads thinking they should both free the
X-Git-Tag: 1.4.28-rc1~11^2~27
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=607defd94a1e8c1c60851d58da8e9fd6858b5e8d;p=thirdparty%2Fasterisk.git

Fix a crash caused by two threads thinking they should both free the
chan_local private structure when only one should.

(closes issue #15314)
Reported by: sroberts
Patches:
      Issue15314_Move_Nulling_owner.patch uploaded by davidw (license 780)
Tested by: davidw, lottc


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@230038 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_local.c b/channels/chan_local.c
index 58692899cf..b39aeccd1e 100644
--- a/channels/chan_local.c
+++ b/channels/chan_local.c
@@ -574,11 +574,11 @@ static int local_hangup(struct ast_channel *ast)
 		ast_clear_flag(p, LOCAL_LAUNCHED_PBX);
 		ast_module_user_remove(p->u_chan);
 	} else {
-		p->owner = NULL;
 		ast_module_user_remove(p->u_owner);
 		while (p->chan && ast_channel_trylock(p->chan)) {
 			DEADLOCK_AVOIDANCE(&p->lock);
 		}
+		p->owner = NULL;
 		if (p->chan) {
 			ast_queue_hangup(p->chan);
 			ast_channel_unlock(p->chan);