Fix another place where peer->callno could change at a very bad time, and also

fix a place where a peer was used after the reference was released.
(inspired by rev 120001)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@120168 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 1691f49db0e6db4b5d4d0c925f7800ffe8d8247a..758f4117bf5786ee3da9cc96fddd659a6ca38de6 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -8801,15 +8801,17 @@ static int iax2_prov_cmd(int fd, int argc, char *argv[])
 static void __iax2_poke_noanswer(const void *data)
 {
        struct iax2_peer *peer = (struct iax2_peer *)data;
+       int callno;
+
        if (peer->lastms > -1) {
                ast_log(LOG_NOTICE, "Peer '%s' is now UNREACHABLE! Time: %d\n", peer->name, peer->lastms);
                manager_event(EVENT_FLAG_SYSTEM, "PeerStatus", "Peer: IAX2/%s\r\nPeerStatus: Unreachable\r\nTime: %d\r\n", peer->name, peer->lastms);
                ast_device_state_changed("IAX2/%s", peer->name); /* Activate notification */
        }
-       if (peer->callno > 0) {
-               ast_mutex_lock(&iaxsl[peer->callno]);
-               iax2_destroy(peer->callno);
-               ast_mutex_unlock(&iaxsl[peer->callno]);
+       if ((callno = peer->callno) > 0) {
+               ast_mutex_lock(&iaxsl[callno]);
+               iax2_destroy(callno);
+               ast_mutex_unlock(&iaxsl[callno]);
        }
        peer->callno = 0;
        peer->lastms = -1;
@@ -8862,7 +8864,7 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall)
        }
        if (heldcall)
                ast_mutex_unlock(&iaxsl[heldcall]);
-       peer->callno = find_callno(0, 0, &peer->addr, NEW_FORCE, peer->sockfd, 0);
+       callno = peer->callno = find_callno(0, 0, &peer->addr, NEW_FORCE, peer->sockfd, 0);
        if (heldcall)
                ast_mutex_lock(&iaxsl[heldcall]);
        if (peer->callno < 1) {
@@ -8893,11 +8895,11 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall)
                peer_unref(peer);
 
        /* And send the poke */
-       ast_mutex_lock(&iaxsl[peer->callno]);
-       if (iaxs[peer->callno]) {
-               send_command(iaxs[peer->callno], AST_FRAME_IAX, IAX_COMMAND_POKE, 0, NULL, 0, -1);
+       ast_mutex_lock(&iaxsl[callno]);
+       if (iaxs[callno]) {
+               send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_POKE, 0, NULL, 0, -1);
        }
-       ast_mutex_unlock(&iaxsl[peer->callno]);
+       ast_mutex_unlock(&iaxsl[callno]);
 
        return 0;
 }