4 files changed, 31 insertions, 17 deletions

diff --git a/main/astobj2.c b/main/astobj2.c
index d8aaca168..e9e2db7e5 100644
--- a/main/astobj2.c
+++ b/main/astobj2.c
@@ -930,12 +930,6 @@ static char *handle_astobj2_test(struct ast_cli_entry *e, int cmd, struct ast_cl
 		ast_cli(a->fd, "object %d allocated as %p\n", i, obj);
 		sprintf(obj, "-- this is obj %d --", i);
 		ao2_link(c1, obj);
-		/* At this point, the refcount on obj is 2 due to the allocation
-		 * and linking. We can go ahead and reduce the refcount by 1
-		 * right here so that when the container is unreffed later, the
-		 * objects will be freed
-		 */
-		ao2_t_ref(obj, -1, "test");
 	}
 	ast_cli(a->fd, "testing callbacks\n");
 	ao2_t_callback(c1, 0, print_cb, &a->fd,"test callback");
diff --git a/main/http.c b/main/http.c
index 405f65d9d..33818af2c 100644
--- a/main/http.c
+++ b/main/http.c
@@ -736,7 +736,8 @@ static void *httpd_helper_thread(void *data)
 
 done:
 	fclose(ser->f);
-	ser = ast_tcptls_session_instance_destroy(ser);
+	ao2_ref(ser, -1);
+	ser = NULL;
 
 	return NULL;
 }
diff --git a/main/manager.c b/main/manager.c
index 6af81c696..61d6da580 100644
--- a/main/manager.c
+++ b/main/manager.c
@@ -3089,7 +3089,8 @@ static void *session_do(void *data)
 	destroy_session(s);
 
 done:
-	ser = ast_tcptls_session_instance_destroy(ser);
+	ao2_ref(ser, -1);
+	ser = NULL;
 	return NULL;
 }
 
diff --git a/main/tcptls.c b/main/tcptls.c
index 67782a08d..9ce3ac9b8 100644
--- a/main/tcptls.c
+++ b/main/tcptls.c
@@ -83,6 +83,12 @@ static int ssl_close(void *cookie)
 
 HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *ser, void *buf, size_t count)
 {
+	if (ser->fd == -1) {
+		ast_log(LOG_ERROR, "server_read called with an fd of -1\n");
+		errno = EIO;
+		return -1;
+	}
+
 #ifdef DO_SSL
 	if (ser->ssl)
 		return ssl_read(ser->ssl, buf, count);
@@ -92,6 +98,12 @@ HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *ser, void *buf
 
 HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *ser, void *buf, size_t count)
 {
+	if (ser->fd == -1) {
+		ast_log(LOG_ERROR, "server_write called with an fd of -1\n");
+		errno = EIO;
+		return -1;
+	}
+
 #ifdef DO_SSL
 	if (ser->ssl)
 		return ssl_write(ser->ssl, buf, count);
@@ -99,6 +111,12 @@ HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *ser, void *bu
 	return write(ser->fd, buf, count);
 }
 
+static void session_instance_destructor(void *obj)
+{
+	struct ast_tcptls_session_instance *i = obj;
+	ast_mutex_destroy(&i->lock);
+}
+
 void *ast_tcptls_server_root(void *data)
 {
 	struct server_args *desc = data;
@@ -123,12 +141,15 @@ void *ast_tcptls_server_root(void *data)
 				ast_log(LOG_WARNING, "Accept failed: %s\n", strerror(errno));
 			continue;
 		}
-		ser = ast_calloc(1, sizeof(*ser));
+		ser = ao2_alloc(sizeof(*ser), session_instance_destructor);
 		if (!ser) {
 			ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
 			close(fd);
 			continue;
 		}
+
+		ast_mutex_init(&ser->lock);
+
 		flags = fcntl(fd, F_GETFL);
 		fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
 		ser->fd = fd;
@@ -140,7 +161,7 @@ void *ast_tcptls_server_root(void *data)
 		if (ast_pthread_create_detached_background(&launched, NULL, ast_make_file_from_fd, ser)) {
 			ast_log(LOG_WARNING, "Unable to launch helper thread: %s\n", strerror(errno));
 			close(ser->fd);
-			ast_free(ser);
+			ao2_ref(ser, -1);
 		}
 	}
 	return NULL;
@@ -235,9 +256,11 @@ struct ast_tcptls_session_instance *ast_tcptls_client_start(struct server_args *
 		goto error;
 	}
 
-	if (!(ser = ast_calloc(1, sizeof(*ser))))
+	if (!(ser = ao2_alloc(sizeof(*ser), session_instance_destructor)))
 		goto error;
 
+	ast_mutex_init(&ser->lock);
+
 	flags = fcntl(desc->accept_fd, F_GETFL);
 	fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);
 
@@ -262,7 +285,7 @@ error:
 	close(desc->accept_fd);
 	desc->accept_fd = -1;
 	if (ser)
-		ast_free(ser);
+		ao2_ref(ser, -1);
 	return NULL;
 }
 
@@ -447,8 +470,3 @@ void *ast_make_file_from_fd(void *data)
 		return ser;
 }
 
-struct ast_tcptls_session_instance *ast_tcptls_session_instance_destroy(struct ast_tcptls_session_instance *i)
-{
-	ast_free(i);
-	return NULL;
-}