On busy systems, it's possible for the values checked within a single line

of code to change, unless the structure is locked to ensure a consistent
state.
(closes issue #13717)
 Reported by: kowalma
 Patches:
       20081102__bug13717.diff.txt uploaded by Corydon76 (license 14)
 Tested by: kowalma

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@154365 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index cdda03ad7bcde2046317d3e7d5bd78fd53e339e2..1c3838ef88191d3c60ae3677fb4c5b1bc2004160 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -1558,12 +1558,21 @@ static int __find_callno(unsigned short callno, unsigned short dcallno, struct s
 
                /* This will occur on the first response to a message that we initiated,
                 * such as a PING. */
+               if (dcallno) {
+                       ast_mutex_lock(&iaxsl[dcallno]);
+               }
                if (callno && dcallno && iaxs[dcallno] && !iaxs[dcallno]->peercallno && match(sin, callno, dcallno, iaxs[dcallno], check_dcallno)) {
                        iaxs[dcallno]->peercallno = callno;
                        res = dcallno;
                        store_by_peercallno(iaxs[dcallno]);
+                       if (!res || !return_locked) {
+                               ast_mutex_unlock(&iaxsl[dcallno]);
+                       }
                        return res;
                }
+               if (dcallno) {
+                       ast_mutex_unlock(&iaxsl[dcallno]);
+               }
 
 #ifdef IAX_OLD_FIND
                /* If we get here, we SHOULD NOT find a call structure for this