From e229e9f010a0bb17739e3236a52d37fb3376c3d9 Mon Sep 17 00:00:00 2001
From: Sean Bright <sean@malleable.com>
Date: Sat, 29 Jan 2011 17:34:22 +0000
Subject: [PATCH] Merged revisions 304730 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.8

................
  r304730 | seanbright | 2011-01-29 12:15:27 -0500 (Sat, 29 Jan 2011) | 22 lines

  Merged revisions 304729 via svnmerge from
  https://origsvn.digium.com/svn/asterisk/branches/1.6.2

  ........
    r304729 | seanbright | 2011-01-29 12:01:51 -0500 (Sat, 29 Jan 2011) | 15 lines

    Make sure that we unref the correct object when ejecting the most recent caller.

    Currently, when we kick the last user to enter, we decrement our own reference
    count which results in a crash when we kick another user or when we exit the
    conference ourselves.

    This will fix #18225 in 1.8 and trunk, but that particular bug does not exist in
    1.6.2.

    (closes issue #18225)
    Reported by: kenji
    Patches:
          issue18225.patch uploaded by seanbright (license 71)
    Tested by: seanbright
  ........
................


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@304772 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
 apps/app_meetme.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/apps/app_meetme.c b/apps/app_meetme.c
index f315d3d938..3ec6e3e38f 100644
--- a/apps/app_meetme.c
+++ b/apps/app_meetme.c
@@ -2206,7 +2206,6 @@ static int user_set_muted_cb(void *obj, void *check_admin_arg, int flags)
 static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struct ast_flags64 *confflags, char *optargs[])
 {
 	struct ast_conf_user *user = NULL;
-	struct ast_conf_user *usr = NULL;
 	int fd;
 	struct dahdi_confinfo dahdic, dahdic_empty;
 	struct ast_frame *f;
@@ -3222,6 +3221,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 							int keepplaying;
 							int playednamerec;
 							struct ao2_iterator user_iter;
+							struct ast_conf_user *usr = NULL;
 							switch(dtmf) {
 							case '1': /* *81 Roll call */
 								keepplaying = 1;
@@ -3260,7 +3260,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 									}
 								}
 								user_iter = ao2_iterator_init(conf->usercontainer, 0);
-								while((user = ao2_iterator_next(&user_iter))) {
+								while((usr = ao2_iterator_next(&user_iter))) {
 									if (ast_fileexists(usr->namerecloc, NULL, NULL)) {
 										if (keepplaying && !ast_streamfile(chan, usr->namerecloc, chan->language)) {
 											res = ast_waitstream(chan, AST_DIGIT_ANY);
@@ -3270,7 +3270,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 										}
 										playednamerec = 1;
 									}
-									ao2_ref(user, -1);
+									ao2_ref(usr, -1);
 								}
 								ao2_iterator_destroy(&user_iter);
 								if (keepplaying && playednamerec && !ast_streamfile(chan, "conf-roll-callcomplete", chan->language)) {
@@ -3414,6 +3414,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 								break;
 							case '3': /* Eject last user */
 							{
+								struct ast_conf_user *usr = NULL;
 								int max_no = 0;
 								ao2_callback(conf->usercontainer, OBJ_NODATA, user_max_cmp, &max_no);
 								menu_active = 0;
@@ -3425,7 +3426,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, struc
 								} else {
 									usr->adminflags |= ADMINFLAG_KICKME;
 								}
-								ao2_ref(user, -1);
+								ao2_ref(usr, -1);
 								ast_stopstream(chan);
 								break;	
 							}