From: Joshua Colp <jcolp@digium.com>
Date: Mon, 9 Dec 2013 18:31:13 +0000 (+0000)
Subject: endpoints: Keep a reference to channel ids when creating snapshot.
X-Git-Tag: 12.0.0~69
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=67ea0c207879865ad9fe9b2b28e1a645ccf586b1;p=thirdparty%2Fasterisk.git

endpoints: Keep a reference to channel ids when creating snapshot.

The snapshot process for endpoints uses the channel ids present
on the endpoint itself. Without keeping a reference it was possible
for the strings to be freed underneath any consumer of an endpoint
snapshot.

A reference is now held by the snapshot to the channel ids and
released when the snapshot is destroyed.

(issue ASTERISK-22801)
Reported by: Matt Jordan


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@403542 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/endpoints.c b/main/endpoints.c
index 9eeadfeef8..4be4eb31b6 100644
--- a/main/endpoints.c
+++ b/main/endpoints.c
@@ -388,8 +388,14 @@ void ast_endpoint_set_max_channels(struct ast_endpoint *endpoint,
 static void endpoint_snapshot_dtor(void *obj)
 {
 	struct ast_endpoint_snapshot *snapshot = obj;
+	int channel;
 
 	ast_assert(snapshot != NULL);
+
+	for (channel = 0; channel < snapshot->num_channels; channel++) {
+		ao2_ref(snapshot->channel_ids[channel], -1);
+	}
+
 	ast_string_field_free_memory(snapshot);
 }
 
@@ -422,8 +428,8 @@ struct ast_endpoint_snapshot *ast_endpoint_snapshot_create(
 
 	i = ao2_iterator_init(endpoint->channel_ids, 0);
 	while ((obj = ao2_iterator_next(&i))) {
-		RAII_VAR(char *, channel_id, obj, ao2_cleanup);
-		snapshot->channel_ids[snapshot->num_channels++] = channel_id;
+		/* The reference is kept so the channel id does not go away until the snapshot is gone */
+		snapshot->channel_ids[snapshot->num_channels++] = obj;
 	}
 	ao2_iterator_destroy(&i);