[Freeswitch-dev] media bug remove codec destroy crash

[Tamas Cseke]

Hello,

We have a segfault. It's not the newest code, so I didn't opened a jira yet.

commit 84d897cb05079a4bfb3ed4ff98df0b5f666e0f70
Date:   Thu Jul 22 01:23:06 2010 -0500

I advised to upgrade but it's not going so fast, and I think I found 
something so I ask before we do the upgarde
I saw there were commits in media bug remove code, but I'm not sure it 
fixes it.

http://pastebin.freeswitch.org/14554

The codec is destroyed in switch_core_media_bug_remove_all although 
switch_codec_ready said it's ready.
I found that it could be removed in bug_remove or bug_prune too.
In those functions the write lock is locked, but in remove_all it's 
unlocked before the codec destroy.
So I think it somehow the bug remove and session hangup happend in the 
same time (I'm not 100% sure it's possible)
and remove_all tried to destroy the codec that was already destroyed.

I think the rwunlock sould go after the codec destroy in remove_all.
Please check, and let me know if my theory make sense :)

Thanks,
Tamas