1) When we get a translated frame out, clone it, because if the

translator pvt is freed before we use the frame, bad things happen.
2) Getting a failure from ast_sched_delete means that the schedule
ID is currently running.  Don't just ignore it.
(Closes issue #11698)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@97973 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 9480b43669ae1f33c81a5f734ca3e79021e7faff..dce4f799d66401f20f0317d40c07169922ad9536 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -2478,11 +2478,18 @@ static void sip_destroy_peer(struct sip_peer *peer)
                ast_variables_destroy(peer->chanvars);
                peer->chanvars = NULL;
        }
-       if (peer->expire > -1)
-               ast_sched_del(sched, peer->expire);
 
-       if (peer->pokeexpire > -1)
-               ast_sched_del(sched, peer->pokeexpire);
+       /* If the schedule delete fails, that means the schedule is currently
+        * running, which means we should wait for that thread to complete.
+        * Otherwise, there's a crashable race condition.
+        *
+        * NOTE: once peer is refcounted, this probably is no longer necessary.
+        */
+       while (peer->expire > -1 && ast_sched_del(sched, peer->expire))
+               usleep(1);
+       while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire))
+               usleep(1);
+
        register_peer_exten(peer, FALSE);
        ast_free_ha(peer->ha);
        if (ast_test_flag(&peer->flags[1], SIP_PAGE2_SELFDESTRUCT))

diff --git a/main/translate.c b/main/translate.c
index e01ce93212e8af231a71b146b86b9f1bf0077092..cc898a5dbb6e9c5982b93c8c534ae802a09b88cb 100644 (file)
--- a/main/translate.c
+++ b/main/translate.c
@@ -232,7 +232,10 @@ struct ast_frame *ast_trans_frameout(struct ast_trans_pvt *pvt,
        f->offset = AST_FRIENDLY_OFFSET;
        f->src = pvt->t->name;
        f->data = pvt->outbuf;
-       return f;
+       /* We must clone the frame, because the pvt could disappear
+        * the moment after we return (and unlock the source channel).
+        */
+       return ast_frisolate(f);
 }
 
 static struct ast_frame *default_frameout(struct ast_trans_pvt *pvt)