Fix a crash in chan_iax2 due to a race condition

(closes issue #11780)
Reported by: guillecabeza
Patches:
      bug_iax2_jb_1.4.patch uploaded by guillecabeza (license 380)
      bug_iax2_jb_trunk.patch uploaded by guillecabeza (license 380)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@103741 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 90ad719946a52679f6a712ae8de4475b6f895494..0f17c80b14cf66644173113219035f0b44595140 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -2515,7 +2515,9 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr
        int type, len;
        int ret;
        int needfree = 0;
-
+       struct ast_channel *owner = NULL;
+       struct ast_channel *bridge = NULL;
+       
        /* Attempt to recover wrapped timestamps */
        unwrap_timestamp(fr);
 
@@ -2547,11 +2549,12 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr
                return -1;
        }
 
+       if ((owner = iaxs[fr->callno]->owner))
+               bridge = ast_bridged_channel(owner);
+
        /* if the user hasn't requested we force the use of the jitterbuffer, and we're bridged to
         * a channel that can accept jitter, then flush and suspend the jb, and send this frame straight through */
-       if( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) &&
-           iaxs[fr->callno]->owner && ast_bridged_channel(iaxs[fr->callno]->owner) &&
-           (ast_bridged_channel(iaxs[fr->callno]->owner)->tech->properties & AST_CHAN_TP_WANTSJITTER)) {
+       if ( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) && owner && bridge && (bridge->tech->properties & AST_CHAN_TP_WANTSJITTER) ) {
                jb_frame frame;
 
                /* deliver any frames in the jb */