kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-27 16:07:15 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merged revisions 219520 via svnmerge from

Browse Source 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r219520 | dvossel | 2009-09-18 18:20:58 -0500 (Fri, 18 Sep 2009) | 15 lines
  
  Merged revisions 219519 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r219519 | dvossel | 2009-09-18 18:19:50 -0500 (Fri, 18 Sep 2009) | 9 lines
    
    iax2 frame double free
    
    The iax frame's retrans sched id was written over right
    before iax2_frame_free was called.  In iax2_frame_free that
    retrans id is used to delete the sched item.  By writing over
    the retrans field before the sched item could be deleted, it was
    possible for a retransmit to occur on a freed frame.
  ........
................


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.2@219521 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
David Vossel
2009-09-18 23:21:41 +00:00
parent 22a376de74
commit 852b01fad8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
channels/chan_iax2.c
+1 -1
View File
@@ -1640,6 +1640,7 @@ static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
static void iax2_frame_free(struct iax_frame *fr)
{
ast_sched_thread_del(sched, fr->retrans);
fr->retrans = -1;
iax_frame_free(fr);
}
@@ -3311,7 +3312,6 @@ static void __attempt_transmit(const void *data)
AST_LIST_LOCK(&frame_queue);
AST_LIST_REMOVE(&frame_queue, f, list);
AST_LIST_UNLOCK(&frame_queue);
f->retrans = -1;
/* Free the IAX frame */
iax2_frame_free(f);
}