kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

[mod_hash] Fix use of remote's hash table after free.

This commit is contained in:
Andrey Volk 2020-02-13 22:02:30 +04:00
parent 53c110ec51
commit 04717a5fb8
1 changed files with 2 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/mod/applications/mod_hash/mod_hash.c
View File

@ -246,7 +246,6 @@ SWITCH_HASH_DELETE_FUNC(limit_hash_remote_cleanup_callback)
switch_time_t now = (switch_time_t)(intptr_t)pData; switch_time_t now = (switch_time_t)(intptr_t)pData;
if (item->last_update != now) { if (item->last_update != now) {
free(item);
return SWITCH_TRUE; return SWITCH_TRUE;
} }
@ -763,8 +762,6 @@ limit_remote_t *limit_remote_create(const char *name, const char *host, uint16_t
void limit_remote_destroy(limit_remote_t **r) void limit_remote_destroy(limit_remote_t **r)
{ {
if (r && *r) { if (r && *r) {
switch_hash_index_t *hi;
(*r)->state = REMOTE_OFF; (*r)->state = REMOTE_OFF;
if ((*r)->thread) { if ((*r)->thread) {
@ -775,20 +772,12 @@ void limit_remote_destroy(limit_remote_t **r)
switch_thread_rwlock_wrlock((*r)->rwlock); switch_thread_rwlock_wrlock((*r)->rwlock);
/* Free hashtable data */ /* Free hashtable data */
for (hi = switch_core_hash_first((*r)->index); hi; hi = switch_core_hash_next(&hi)) { switch_core_hash_destroy(&(*r)->index);
void *val;
const void *key;
switch_ssize_t keylen;
switch_core_hash_this(hi, &key, &keylen, &val);
free(val);
}
switch_thread_rwlock_unlock((*r)->rwlock); switch_thread_rwlock_unlock((*r)->rwlock);
switch_thread_rwlock_destroy((*r)->rwlock); switch_thread_rwlock_destroy((*r)->rwlock);
switch_core_destroy_memory_pool(&((*r)->pool)); switch_core_destroy_memory_pool(&((*r)->pool));
switch_core_hash_destroy(&(*r)->index);
*r = NULL; *r = NULL;
} }
} }
@ -881,7 +870,7 @@ static void *SWITCH_THREAD_FUNC limit_remote_thread(switch_thread_t *thread, voi
switch_thread_rwlock_wrlock(remote->rwlock); switch_thread_rwlock_wrlock(remote->rwlock);
if (!(item = switch_core_hash_find(remote->index, argv[0]))) { if (!(item = switch_core_hash_find(remote->index, argv[0]))) {
item = malloc(sizeof(*item)); item = malloc(sizeof(*item));
switch_core_hash_insert(remote->index, argv[0], item); switch_core_hash_insert_auto_free(remote->index, argv[0], item);
} }
item->total_usage = atoi(argv[1]); item->total_usage = atoi(argv[1]);
item->rate_usage = atoi(argv[2]); item->rate_usage = atoi(argv[2]);