diff options
| author | Russell Bryant <russell@russellbryant.com> | 2014-01-27 01:25:23 +0000 |
|---|---|---|
| committer | Russell Bryant <russell@russellbryant.com> | 2014-01-27 01:25:23 +0000 |
| commit | 33071d636cff3085be3bcc01bbba9d38ca9acb46 (patch) | |
| tree | 14f4ac34e6aa413ffacd8b583a993b4911d752fe /main/file.c | |
| parent | 45261449ecfe621e2ba5e371a7c24addfa8a9c72 (diff) | |
Protect ast_filestream object when on a channel
The ast_filestream object gets tacked on to a channel via
chan->timingdata. It's a reference counted object, but the reference
count isn't used when putting it on a channel. It's theoretically
possible for another thread to interfere with the channel while it's
unlocked and cause the filestream to get destroyed.
Use the astobj2 reference count to make sure that as long as this code
path is holding on the ast_filestream and passing it into the file.c
playback code, that it knows it's valid.
Bug reported by Leif Madsen.
Review: https://reviewboard.asterisk.org/r/3135/
........
Merged revisions 406566 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 406567 from http://svn.asterisk.org/svn/asterisk/branches/11
........
Merged revisions 406574 from http://svn.asterisk.org/svn/asterisk/branches/12
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@406595 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'main/file.c')
| -rw-r--r-- | main/file.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/main/file.c b/main/file.c index ffdbf1821..458f25446 100644 --- a/main/file.c +++ b/main/file.c @@ -902,7 +902,7 @@ static enum fsread_res ast_readaudio_callback(struct ast_filestream *s) rate = (unsigned int) roundf(samp_rate / ((float) whennext)); - ast_settimeout(s->owner, rate, ast_fsread_audio, s); + ast_settimeout_full(s->owner, rate, ast_fsread_audio, s, 1); } else { ast_channel_streamid_set(s->owner, ast_sched_add(ast_channel_sched(s->owner), whennext / (ast_format_rate(&s->fmt->format) / 1000), ast_fsread_audio, s)); } |