Merged revisions 219519 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r219519 | dvossel | 2009-09-18 18:19:50 -0500 (Fri, 18 Sep 2009) | 9 lines iax2 frame double free The iax frame's retrans sched id was written over right before iax2_frame_free was called. In iax2_frame_free that retrans id is used to delete the sched item. By writing over the retrans field before the sched item could be deleted, it was possible for a retransmit to occur on a freed frame. ........ git-svn-id: http://svn.digium.com/svn/asterisk/trunk@219520 f38db490-d61c-443f-a65b-d21fe96a405b
This commit is contained in:
parent
8a55297f29
commit
c6b45bd6c9
1 changed files with 1 additions and 1 deletions
|
@ -1685,6 +1685,7 @@ static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
|
|||
static void iax2_frame_free(struct iax_frame *fr)
|
||||
{
|
||||
ast_sched_thread_del(sched, fr->retrans);
|
||||
fr->retrans = -1;
|
||||
iax_frame_free(fr);
|
||||
}
|
||||
|
||||
|
@ -3352,7 +3353,6 @@ static void __attempt_transmit(const void *data)
|
|||
/* Don't attempt delivery, just remove it from the queue */
|
||||
AST_LIST_REMOVE(&frame_queue[callno], f, list);
|
||||
ast_mutex_unlock(&iaxsl[callno]);
|
||||
f->retrans = -1;
|
||||
/* Free the IAX frame */
|
||||
iax2_frame_free(f);
|
||||
} else if (callno) {
|
||||
|
|
Reference in a new issue