From c46c9945a89f43b7e07fdd9fd787c8d78761d5f3 Mon Sep 17 00:00:00 2001 From: aabolfazl Date: Sun, 2 Aug 2026 19:49:37 +0300 Subject: [PATCH] res_musiconhold: Fix mohclass reference leak on answeredonly early return. local_ast_moh_start() returns -1 from the answeredonly check without releasing the mohclass reference it holds, unlike every other exit path in the function. Nothing else ever releases that reference, so moh_class_destructor() never runs for the object. With realtime music on hold and cachertclasses disabled, each suppressed request leaks the class object, its monitor thread, the external application process and two file descriptors for the lifetime of Asterisk. For static classes the stale references prevent the class from ever being destroyed after it is replaced by a reload. Release the reference before returning, matching the other exit paths. Fixes: #2051 --- res/res_musiconhold.c | 1 + 1 file changed, 1 insertion(+) diff --git a/res/res_musiconhold.c b/res/res_musiconhold.c index 505bc14c27..a5fe749366 100644 --- a/res/res_musiconhold.c +++ b/res/res_musiconhold.c @@ -1916,6 +1916,7 @@ static int local_ast_moh_start(struct ast_channel *chan, const char *mclass, con if (mohclass->answeredonly && (ast_channel_state(chan) != AST_STATE_UP)) { ast_verb(3, "The channel '%s' is not answered yet. Ignore the moh request.\n", ast_channel_name(chan)); + mohclass = mohclass_unref(mohclass, "unreffing local reference to mohclass (channel not answered)"); return -1; } -- 2.47.3