From 86184a2f73722d104632427225bb8237e3693fc7 Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Wed, 25 Oct 2017 14:20:45 -0500 Subject: [PATCH] FS-10757: [mod_conference] Race condition freeing avatar image #resolve --- src/mod/applications/mod_conference/conference_loop.c | 2 ++ src/mod/applications/mod_conference/conference_member.c | 2 ++ src/mod/applications/mod_conference/conference_video.c | 8 ++++++++ 3 files changed, 12 insertions(+) diff --git a/src/mod/applications/mod_conference/conference_loop.c b/src/mod/applications/mod_conference/conference_loop.c index f7379f54f6..3992dd2751 100644 --- a/src/mod/applications/mod_conference/conference_loop.c +++ b/src/mod/applications/mod_conference/conference_loop.c @@ -742,7 +742,9 @@ void *SWITCH_THREAD_FUNC conference_loop_input(switch_thread_t *thread, void *ob if (switch_channel_test_flag(channel, CF_VIDEO) && !conference_utils_member_test_flag(member, MFLAG_ACK_VIDEO)) { conference_utils_member_set_flag_locked(member, MFLAG_ACK_VIDEO); + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + switch_mutex_unlock(member->flag_mutex); conference_video_check_avatar(member, SWITCH_FALSE); switch_core_session_video_reinit(member->session); conference_video_set_floor_holder(member->conference, member, SWITCH_FALSE); diff --git a/src/mod/applications/mod_conference/conference_member.c b/src/mod/applications/mod_conference/conference_member.c index 3f70ac3ec2..e9a87db162 100644 --- a/src/mod/applications/mod_conference/conference_member.c +++ b/src/mod/applications/mod_conference/conference_member.c @@ -1166,9 +1166,11 @@ switch_status_t conference_member_del(conference_obj_t *conference, conference_m last = imember; } + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); switch_img_free(&member->video_mute_img); switch_img_free(&member->pcanvas_img); + switch_mutex_unlock(member->flag_mutex); switch_thread_rwlock_unlock(member->rwlock); diff --git a/src/mod/applications/mod_conference/conference_video.c b/src/mod/applications/mod_conference/conference_video.c index 8daf4108e4..7877ca3e0a 100644 --- a/src/mod/applications/mod_conference/conference_video.c +++ b/src/mod/applications/mod_conference/conference_video.c @@ -1861,8 +1861,10 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo avatar = var; } + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + if (avatar) { member->avatar_png_img = switch_img_read_png(avatar, SWITCH_IMG_FMT_I420); } @@ -1875,6 +1877,8 @@ void conference_video_check_avatar(conference_member_t *member, switch_bool_t fo member->auto_avatar = 1; } + switch_mutex_unlock(member->flag_mutex); + if (canvas) { switch_mutex_unlock(canvas->mutex); conference_video_release_canvas(&canvas); @@ -1894,7 +1898,9 @@ void conference_video_check_flush(conference_member_t *member, switch_bool_t for if ((flushed || force) && member->auto_avatar) { switch_channel_video_sync(member->channel); + switch_mutex_lock(member->flag_mutex); switch_img_free(&member->avatar_png_img); + switch_mutex_unlock(member->flag_mutex); member->avatar_patched = 0; conference_video_reset_video_bitrate_counters(member); member->blanks = 0; @@ -2723,6 +2729,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr } } + switch_mutex_lock(imember->flag_mutex); if (imember->avatar_png_img) { if (layer) { if (!imember->avatar_patched || !layer->cur_img) { @@ -2736,6 +2743,7 @@ void *SWITCH_THREAD_FUNC conference_video_muxing_thread_run(switch_thread_t *thr } switch_img_free(&img); } + switch_mutex_unlock(imember->flag_mutex); if (!layer && (!conference_utils_test_flag(imember->conference, CFLAG_VIDEO_REQUIRED_FOR_CANVAS) || ((switch_channel_test_flag(imember->channel, CF_VIDEO_READY) && switch_core_session_media_flow(imember->session, SWITCH_MEDIA_TYPE_VIDEO) != SWITCH_MEDIA_FLOW_SENDONLY && switch_core_session_media_flow(imember->session, SWITCH_MEDIA_TYPE_VIDEO) != SWITCH_MEDIA_FLOW_INACTIVE)))) { if (conference_video_find_layer(conference, canvas, imember, &layer) == SWITCH_STATUS_SUCCESS) {