kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-02 10:22:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

iax2 frame double free

Browse Source 
The iax frame's retrans sched id was written over right
before iax2_frame_free was called.  In iax2_frame_free that
retrans id is used to delete the sched item.  By writing over
the retrans field before the sched item could be deleted, it was
possible for a retransmit to occur on a freed frame.



git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@219519 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
David Vossel
2009-09-18 23:19:50 +00:00
parent 66fff128f0
commit 0a3504f74b
1 changed files with 0 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
channels/chan_iax2.c
View File

@@ -3064,7 +3064,6 @@ static void __attempt_transmit(const void *data)
AST_LIST_REMOVE(&iaxq.queue, f, list);
iaxq.count--;
AST_LIST_UNLOCK(&iaxq.queue);
f->retrans = -1;
/* Free the IAX frame */
iax2_frame_free(f);
}