From: Mark Murawki <markm@intellasoft.net>
Date: Mon, 18 Jul 2011 20:50:13 +0000 (+0000)
Subject: Merged revisions 328663 via svnmerge from
X-Git-Tag: 10.0.0-beta1~3^2~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d91c13308e6fb98c4341b8bc88e167314a5fa8eb;p=thirdparty%2Fasterisk.git

Merged revisions 328663 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.8

........
  r328663 | markm | 2011-07-18 16:47:04 -0400 (Mon, 18 Jul 2011) | 9 lines

  app_dial may double free a channel datastore

  When starting a call with originate, and having the callee channel run Bridge() on pickup, we will double free the dialed_interface_info datastore, causing a crash.  Make sure to check if the datastore still exists before trying to free it.

  (closes issue ASTERISK-17917)
  Reported by: Mark Murawski
  Tested by: Mark Murawski
........


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.10@328664 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/apps/app_dial.c b/apps/app_dial.c
index f144d48ea2..65f5666f2f 100644
--- a/apps/app_dial.c
+++ b/apps/app_dial.c
@@ -2409,7 +2409,8 @@ static int dial_exec_full(struct ast_channel *chan, const char *data, struct ast
 	 * datastore again, causing a crash
 	 */
 	ast_channel_lock(chan);
-	if (!ast_channel_datastore_remove(chan, datastore)) {
+	datastore = ast_channel_datastore_find(chan, &dialed_interface_info, NULL); /* make sure we weren't cleaned up already */
+	if (datastore && !ast_channel_datastore_remove(chan, datastore)) {
 		ast_datastore_free(datastore);
 	}
 	ast_channel_unlock(chan);