From 9cc4a5b792c8b09e9abc1a5cd3f32dcbe7f90be3 Mon Sep 17 00:00:00 2001 From: David Vossel Date: Wed, 7 Oct 2009 17:41:21 +0000 Subject: [PATCH] crash on transfer handle_invite_replaces() attempts to uplock a pvt's owner channel without first verifing that it exists. (issue #16027) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@222542 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 86dcad9e5f..b77876794d 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -14229,7 +14229,10 @@ static int handle_invite_replaces(struct sip_pvt *p, struct sip_request *req, in can't harm */ transmit_response_with_sdp(p, "200 OK", req, XMIT_RELIABLE); /* Do something more clever here */ - ast_channel_unlock(c); + if (c) { + *nounlock = 1; + ast_channel_unlock(c); + } ast_channel_unlock(replacecall); ast_mutex_unlock(&p->refer->refer_call->lock); return 1; -- 2.47.2