From: Richard Mudgett <rmudgett@digium.com>
Date: Tue, 1 Mar 2016 02:41:55 +0000 (-0600)
Subject: res_pjsip_send_to_voicemail.c: Fix off-nominal double channel unref.
X-Git-Tag: 14.0.0-beta1~368^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=75ec137e91d60795f8c85ab42ed134dd0bc07129;p=thirdparty%2Fasterisk.git

res_pjsip_send_to_voicemail.c: Fix off-nominal double channel unref.

* Fix double unref of other_party channel in off nominal path.

* This is unlikely to be a real problem.  However, for safety,
in handle_incoming_request() keep the datastore ref with the
other_party channel ref until we are finished with the other_party
channel.

Change-Id: I78f22547bf0bb99fb20814ceab75952bd857f821
---

diff --git a/res/res_pjsip_send_to_voicemail.c b/res/res_pjsip_send_to_voicemail.c
index 9d2b5b14b5..cd0f05f273 100644
--- a/res/res_pjsip_send_to_voicemail.c
+++ b/res/res_pjsip_send_to_voicemail.c
@@ -160,12 +160,10 @@ static int handle_incoming_request(struct ast_sip_session *session, struct pjsip
 	sip_session_datastore->data = other_party;
 
 	if (ast_sip_session_add_datastore(session, sip_session_datastore)) {
-		ast_channel_unref(other_party);
 		ao2_ref(sip_session_datastore, -1);
 		send_response(session, 500, rdata);
 		return -1;
 	}
-	ao2_ref(sip_session_datastore, -1);
 
 	if (has_feature) {
 		pbx_builtin_setvar_helper(other_party, SEND_TO_VM_HEADER,
@@ -177,6 +175,7 @@ static int handle_incoming_request(struct ast_sip_session *session, struct pjsip
 					  SEND_TO_VM_REDIRECT_VALUE);
 	}
 
+	ao2_ref(sip_session_datastore, -1);
 	return 0;
 }