From: Richard Mudgett <rmudgett@digium.com>
Date: Mon, 25 Apr 2011 21:49:00 +0000 (+0000)
Subject: When using MGCP realtime gateway definitions, random crashes occur.
X-Git-Tag: 1.8.5-rc1~11^2~199
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ced679eef9ddb343df773b8fe6600fa1066fe9c6;p=thirdparty%2Fasterisk.git

When using MGCP realtime gateway definitions, random crashes occur.

Fixed incorrect linked list node removal for realtime gateways.

(closes issue #18291)
Reported by: nahuelgreco
Patches:
      dangling-pointers-when-pruning.patch uploaded by nahuelgreco (license 162)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@315349 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 499b5e55e6..ea5af86df8 100644
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -3754,7 +3754,7 @@ static void *do_monitor(void *data)
 {
 	int res;
 	int reloading;
-	struct mgcp_gateway *g, *gprev, *gnext;
+	struct mgcp_gateway *g, *gprev;
 	/*struct mgcp_gateway *g;*/
 	/*struct mgcp_endpoint *e;*/
 	/*time_t thispass = 0, lastpass = 0;*/
@@ -3824,12 +3824,10 @@ static void *do_monitor(void *data)
 			g = gateways;
 			gprev = NULL;
 			while(g) {
-				gnext = g->next;
 				if(g->realtime) {
 					if(mgcp_prune_realtime_gateway(g)) {
 						if(gprev) {
-							gprev->next = gnext;
-							gprev = g;
+							gprev->next = g->next;
 						} else {
 							gateways = g->next;
 						}
@@ -3843,7 +3841,7 @@ static void *do_monitor(void *data)
 				} else {
 					gprev = g;
 				}
-				g = gnext;
+				g = g->next;
 			}
 			ast_mutex_unlock(&gatelock);
 			lastrun = time(NULL);