When using MGCP realtime gateway definitions, random crashes occur.

Fixed incorrect linked list node removal for realtime gateways.

(closes issue #18291)
Reported by: nahuelgreco
Patches:
      dangling-pointers-when-pruning.patch uploaded by nahuelgreco (license 162)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@315349 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 499b5e55e6b2f7b7522b6316278d319a71cc8a18..ea5af86df8a91bb38cc9bd60a136feb50c00af19 100644 (file)
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -3754,7 +3754,7 @@ static void *do_monitor(void *data)
 {
        int res;
        int reloading;
-       struct mgcp_gateway *g, *gprev, *gnext;
+       struct mgcp_gateway *g, *gprev;
        /*struct mgcp_gateway *g;*/
        /*struct mgcp_endpoint *e;*/
        /*time_t thispass = 0, lastpass = 0;*/
@@ -3824,12 +3824,10 @@ static void *do_monitor(void *data)
                        g = gateways;
                        gprev = NULL;
                        while(g) {
-                               gnext = g->next;
                                if(g->realtime) {
                                        if(mgcp_prune_realtime_gateway(g)) {
                                                if(gprev) {
-                                                       gprev->next = gnext;
-                                                       gprev = g;
+                                                       gprev->next = g->next;
                                                } else {
                                                        gateways = g->next;
                                                }
@@ -3843,7 +3841,7 @@ static void *do_monitor(void *data)
                                } else {
                                        gprev = g;
                                }
-                               g = gnext;
+                               g = g->next;
                        }
                        ast_mutex_unlock(&gatelock);
                        lastrun = time(NULL);