From 03576e82b804b326ce9fd39fa4d39639655408ba Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Wed, 25 Oct 2017 14:20:45 -0500 Subject: [PATCH] FS-10757: [mod_conference] Race condition freeing avatar image #resolve --- src/mod/applications/mod_conference/conference_loop.c | 2 ++ src/mod/applications/mod_conference/conference_member.c | 2 ++ src/mod/applications/mod_conference/conference_video.c | 8 ++++++++ 3 files changed, 12 insertions(+) diff --git a/src/mod/applications/mod_conference/conference_loop.c b/src/mod/applications/mod_conference/conference_loop.c index f23491af85..6f162d247f 100644 --- a/src/mod/applications/mod_conference/conference_loop.c +++ b/src/mod/applications/mod_conference/conference_loop.c @@ -832,7 +832,9 @@ void *SWITCH_THREAD_FUNC conference_loop_input(switch_thread_t *thread, void *ob if (switch_channel_test_flag(channel, CF_VIDEO) && !conference_utils_member_test_flag(member, MFLAG_ACK_VIDEO)) { conference_utils_member_set_flag_locked(member, MFLAG_ACK_VIDEO); + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + switch_mutex_unlock(member->flag_mutex); conference_video_check_avatar(member, SWITCH_FALSE); switch_core_session_video_reinit(member->session); conference_video_set_floor_holder(member->conference, member, SWITCH_FALSE); diff --git a/src/mod/applications/mod_conference/conference_member.c b/src/mod/applications/mod_conference/conference_member.c index ea80527ac8..b9dc9888cd 100644 --- a/src/mod/applications/mod_conference/conference_member.c +++ b/src/mod/applications/mod_conference/conference_member.c @@ -1191,9 +1191,11 @@ switch_status_t conference_member_del(conference_obj_t *conference, conference_m last = imember; } + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); switch_img_free(&member->video_mute_img); switch_img_free(&member->pcanvas_img); + switch_mutex_unlock(member->flag_mutex); switch_thread_rwlock_unlock(member->rwlock); diff --git a/src/mod/applications/mod_conference/conference_video.c b/src/mod/applications/mod_conference/conference_video.c index ba2b6566b8..9479152ec8 100644 --- a/src/mod/applications/mod_conference/conference_video.c +++ b/src/mod/applications/mod_conference/conference_video.c @@ -2371,8 +2371,10 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo avatar = var; } + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + if (avatar) { member->avatar_png_img = switch_img_read_png(avatar, SWITCH_IMG_FMT_I420); } @@ -2385,6 +2387,8 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo member->auto_avatar = 1; } + switch_mutex_unlock(member->flag_mutex); + if (canvas) { switch_mutex_unlock(canvas->mutex); conference_video_release_canvas(&canvas); @@ -2404,7 +2408,9 @@ void conference_video_check_flush(conference_member_t *member, switch_bool_t for if ((flushed || force) && member->auto_avatar) { switch_channel_video_sync(member->channel); + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + switch_mutex_unlock(member->flag_mutex); member->avatar_patched = 0; conference_video_reset_video_bitrate_counters(member); member->blanks = 0; @@ -3329,6 +3335,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr } } + switch_mutex_lock(imember->flag_mutex); if (imember->avatar_png_img) { if (layer) { if (!imember->avatar_patched || !layer->cur_img) { @@ -3342,6 +3349,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr } switch_img_free(&img); } + switch_mutex_unlock(imember->flag_mutex); if (imember->video_layer_id < 0) { layer = NULL;