diff options
| author | mmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-04-17 16:48:47 +0000 |
|---|---|---|
| committer | mmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-04-17 16:48:47 +0000 |
| commit | 9f73bdd388dd74512a00a0072b29e85722649157 (patch) | |
| tree | 4480c9f10ea06c275ca5815cd8465c6713e73343 /include | |
| parent | 031da201bb6d063f89d3f099171b0b86c5eb9093 (diff) | |
Merged revisions 114208 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk
................
r114208 | mmichelson | 2008-04-17 11:40:12 -0500 (Thu, 17 Apr 2008) | 20 lines
Merged revisions 114207 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r114207 | mmichelson | 2008-04-17 11:28:03 -0500 (Thu, 17 Apr 2008) | 12 lines
It was possible for a reference to a frame which was part of a freed DSP to still be
referenced, leading to memory corruption and eventual crashes. This code change ensures
that the dsp is freed when we are finished with the frame. This change is very similar
to a change Russell made with translators back a month or so ago.
(closes issue #11999)
Reported by: destiny6628
Patches:
11999.patch uploaded by putnopvut (license 60)
Tested by: destiny6628, victoryure
........
................
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.0@114210 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'include')
| -rw-r--r-- | include/asterisk/dsp.h | 12 | ||||
| -rw-r--r-- | include/asterisk/frame.h | 4 |
2 files changed, 16 insertions, 0 deletions
diff --git a/include/asterisk/dsp.h b/include/asterisk/dsp.h index 10ed53d1b..6f635a83d 100644 --- a/include/asterisk/dsp.h +++ b/include/asterisk/dsp.h @@ -115,4 +115,16 @@ int ast_dsp_get_tstate(struct ast_dsp *dsp); /*! \brief Get tcount (Threshold counter) */ int ast_dsp_get_tcount(struct ast_dsp *dsp); +/*! + * \brief Hint that a frame from a dsp was freed + * + * This is called from ast_frame_free if AST_FRFLAG_FROM_DSP is set. This occurs + * because it is possible for the dsp to be freed while someone still holds a reference + * to the frame that is in that dsp. This has been known to happen when the dsp on a Zap + * channel detects a busy signal. The channel is hung up, and the application that read the + * frame to begin with still has a reference to the frame. + * + * \return nothing + */ +void ast_dsp_frame_freed(struct ast_frame *fr); #endif /* _ASTERISK_DSP_H */ diff --git a/include/asterisk/frame.h b/include/asterisk/frame.h index ad4b82920..719048b02 100644 --- a/include/asterisk/frame.h +++ b/include/asterisk/frame.h @@ -130,6 +130,10 @@ enum { * The translator can not be free'd if the frame inside of it still has * this flag set. */ AST_FRFLAG_FROM_TRANSLATOR = (1 << 1), + /*! This frame came from a dsp and is still the original frame. + * The dsp cannot be free'd if the frame inside of it still has + * this flag set. */ + AST_FRFLAG_FROM_DSP = (1 << 2), }; /*! \brief Data structure associated with a single frame of data |