From 33071d636cff3085be3bcc01bbba9d38ca9acb46 Mon Sep 17 00:00:00 2001 From: Russell Bryant Date: Mon, 27 Jan 2014 01:25:23 +0000 Subject: Protect ast_filestream object when on a channel The ast_filestream object gets tacked on to a channel via chan->timingdata. It's a reference counted object, but the reference count isn't used when putting it on a channel. It's theoretically possible for another thread to interfere with the channel while it's unlocked and cause the filestream to get destroyed. Use the astobj2 reference count to make sure that as long as this code path is holding on the ast_filestream and passing it into the file.c playback code, that it knows it's valid. Bug reported by Leif Madsen. Review: https://reviewboard.asterisk.org/r/3135/ ........ Merged revisions 406566 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 406567 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 406574 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@406595 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- main/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'main/file.c') diff --git a/main/file.c b/main/file.c index ffdbf1821..458f25446 100644 --- a/main/file.c +++ b/main/file.c @@ -902,7 +902,7 @@ static enum fsread_res ast_readaudio_callback(struct ast_filestream *s) rate = (unsigned int) roundf(samp_rate / ((float) whennext)); - ast_settimeout(s->owner, rate, ast_fsread_audio, s); + ast_settimeout_full(s->owner, rate, ast_fsread_audio, s, 1); } else { ast_channel_streamid_set(s->owner, ast_sched_add(ast_channel_sched(s->owner), whennext / (ast_format_rate(&s->fmt->format) / 1000), ast_fsread_audio, s)); } -- cgit v1.2.3