From ef26718388ea136486517dee9a0eb1996c4b7e0f Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Thu, 6 Jul 2017 14:39:24 -0500 Subject: [PATCH] FS-10473: [freeswitch-core] FreeSWITCH crash - Null event pointer dereference during conference_cdr_del #resolve --- .../applications/mod_conference/mod_conference.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/mod/applications/mod_conference/mod_conference.c b/src/mod/applications/mod_conference/mod_conference.c index 3920c766ce..a43a1eeb5d 100644 --- a/src/mod/applications/mod_conference/mod_conference.c +++ b/src/mod/applications/mod_conference/mod_conference.c @@ -747,12 +747,6 @@ void *SWITCH_THREAD_FUNC conference_thread_run(switch_thread_t *thread, void *ob conference_file_stop(conference, FILE_STOP_ASYNC); conference_file_stop(conference, FILE_STOP_ALL); - for (np = conference->cdr_nodes; np; np = np->next) { - if (np->var_event) { - switch_event_destroy(&np->var_event); - } - } - switch_mutex_lock(conference->member_mutex); for (imember = conference->members; imember; imember = imember->next) { switch_channel_t *channel; @@ -831,9 +825,17 @@ void *SWITCH_THREAD_FUNC conference_thread_run(switch_thread_t *thread, void *ob conference_event_add_data(conference, event); switch_event_add_header_string(event, SWITCH_STACK_BOTTOM, "Action", "conference-destroy"); switch_event_fire(&event); - + + switch_mutex_lock(conference->member_mutex); conference_cdr_render(conference); + for (np = conference->cdr_nodes; np; np = np->next) { + if (np->var_event) { + switch_event_destroy(&np->var_event); + } + } + switch_mutex_unlock(conference->member_mutex); + switch_mutex_lock(conference_globals.setup_mutex); if (conference->layout_hash) { switch_core_hash_destroy(&conference->layout_hash);