diff options
| author | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-09-18 23:21:41 +0000 |
|---|---|---|
| committer | dvossel <dvossel@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-09-18 23:21:41 +0000 |
| commit | d447742f5a331c4408b841efe8c21a2e3d160ced (patch) | |
| tree | 40abd505eac801287e9d39bbe2da96c81b9c4ca7 /channels | |
| parent | beaee5416e737b8ae6abbb7170f173e951d91352 (diff) | |
Merged revisions 219520 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk
................
r219520 | dvossel | 2009-09-18 18:20:58 -0500 (Fri, 18 Sep 2009) | 15 lines
Merged revisions 219519 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r219519 | dvossel | 2009-09-18 18:19:50 -0500 (Fri, 18 Sep 2009) | 9 lines
iax2 frame double free
The iax frame's retrans sched id was written over right
before iax2_frame_free was called. In iax2_frame_free that
retrans id is used to delete the sched item. By writing over
the retrans field before the sched item could be deleted, it was
possible for a retransmit to occur on a freed frame.
........
................
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@219521 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_iax2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index c659e8b41..0116d7c5d 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -1640,6 +1640,7 @@ static void iax2_destroy_helper(struct chan_iax2_pvt *pvt) static void iax2_frame_free(struct iax_frame *fr) { ast_sched_thread_del(sched, fr->retrans); + fr->retrans = -1; iax_frame_free(fr); } @@ -3311,7 +3312,6 @@ static void __attempt_transmit(const void *data) AST_LIST_LOCK(&frame_queue); AST_LIST_REMOVE(&frame_queue, f, list); AST_LIST_UNLOCK(&frame_queue); - f->retrans = -1; /* Free the IAX frame */ iax2_frame_free(f); } |