Don't crash when destroying chan_dahdi pseudo channels.

Must do a deep copy of the cc_params in duplicate_pseudo().  Otherwise,
when the duplicate pseudo channel is destroyed, it frees the original
pseudo channel cc_params.  The original pseudo channel is then left with a
dangling pointer for when the next duplicated pseudo channel is created.


git-svn-id: http://svn.digium.com/svn/asterisk/trunk@262743 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 10 insertions, 1 deletions

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 601c6efd1..51e64ee35 100644
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -12427,6 +12427,15 @@ static struct dahdi_pvt *duplicate_pseudo(struct dahdi_pvt *src)
 		return NULL;
 	}
 	*p = *src;
+
+	/* Must deep copy the cc_params. */
+	p->cc_params = ast_cc_config_params_init();
+	if (!p->cc_params) {
+		ast_free(p);
+		return NULL;
+	}
+	ast_cc_copy_config_params(p->cc_params, src->cc_params);
+
 	p->which_iflist = DAHDI_IFLIST_NONE;
 	p->next = NULL;
 	p->prev = NULL;
@@ -17559,7 +17568,7 @@ static void deep_copy_dahdi_chan_conf(struct dahdi_chan_conf *dest, const struct
 	struct ast_cc_config_params *cc_params;
 
 	cc_params = dest->chan.cc_params;
-	memcpy(dest, src, sizeof(dest));
+	*dest = *src;
 	dest->chan.cc_params = cc_params;
 	ast_cc_copy_config_params(dest->chan.cc_params, src->chan.cc_params);
 }