From 6429a27b88769e30259b55779418a616e1d44311 Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Tue, 23 Aug 2016 10:42:08 -0500 Subject: [PATCH] ast_framehook_detach() must be called with the channel locked. The framehook container could become corrupted if the channel lock is not held before calling. Change-Id: If0a1c7ba0484ed3a191106a7516526b905952584 --- res/res_fax.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/res/res_fax.c b/res/res_fax.c index ad62f026de..ee0dc8c029 100644 --- a/res/res_fax.c +++ b/res/res_fax.c @@ -4055,7 +4055,9 @@ static int acf_faxopt_write(struct ast_channel *chan, const char *cmd, char *dat ast_log(LOG_WARNING, "Attempt to attach a T.38 gateway on channel (%s) with gateway already running.\n", ast_channel_name(chan)); } } else if (ast_false(val)) { + ast_channel_lock(chan); ast_framehook_detach(chan, details->gateway_id); + ast_channel_unlock(chan); details->gateway_id = -1; } else { ast_log(LOG_WARNING, "Unsupported value '%s' passed to FAXOPT(%s).\n", value, data); @@ -4100,7 +4102,9 @@ static int acf_faxopt_write(struct ast_channel *chan, const char *cmd, char *dat ast_log(LOG_WARNING, "Attempt to attach a FAX detect on channel (%s) with FAX detect already running.\n", ast_channel_name(chan)); } } else if (ast_false(val)) { + ast_channel_lock(chan); ast_framehook_detach(chan, details->faxdetect_id); + ast_channel_unlock(chan); details->faxdetect_id = -1; } else { ast_log(LOG_WARNING, "Unsupported value '%s' passed to FAXOPT(%s).\n", value, data); -- 2.47.2