retronetworking
/
freeswitch
13
0
Fork 0
Code Pull Requests Releases Activity

FreeTDM: Don't ftdm_safe_free() span information in ftdm_span_destroy() if span provides a custom span_destroy callback. 

Doing so will cause a NULL-deref segfault while removing the current span from the
global hash (cur_span->name == NULL) in ftdm_global_destroy().

Remove all the ftdm_safe_free() calls in the custom callback part of ftdm_span_destroy() and
let ftdm_global_destroy() handle that.

NOTE: Also adds a missing ftdm_safe_free(cur_span->dtmf_hangup) to ftdm_global_destroy().

Signed-off-by: Stefan Knoblich <stkn@openisdn.net>
This commit is contained in:
Stefan Knoblich 2011-09-01 01:35:01 +02:00
parent ead5790c99
commit 41b956fd24
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libs/freetdm/src/ftdm_io.c
View File

@ -649,9 +649,6 @@ static ftdm_status_t ftdm_span_destroy(ftdm_span_t *span)
if (span->fio->span_destroy(span) != FTDM_SUCCESS) {
status = FTDM_FAIL;
}
ftdm_safe_free(span->type);
ftdm_safe_free(span->name);
ftdm_safe_free(span->dtmf_hangup);
}
/* destroy final basic resources of the span data structure */
@ -5774,6 +5771,7 @@ FT_DECLARE(ftdm_status_t) ftdm_global_destroy(void)
}
hashtable_remove(globals.span_hash, (void *)cur_span->name);
ftdm_safe_free(cur_span->dtmf_hangup);
ftdm_safe_free(cur_span->type);
ftdm_safe_free(cur_span->name);
ftdm_safe_free(cur_span);