aboutsummaryrefslogtreecommitdiffstats
path: root/main
diff options
context:
space:
mode:
authormmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b>2008-04-17 16:28:03 +0000
committermmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b>2008-04-17 16:28:03 +0000
commit2fd6d65504ad48784a19ef212f370e61d59e2125 (patch)
treef12fa5e6d241ba8ea454c070b260a081e6e1c2a5 /main
parent3f3aac1ad67aec3dc003bb7e4f7ad7183e7340a7 (diff)
It was possible for a reference to a frame which was part of a freed DSP to still be
referenced, leading to memory corruption and eventual crashes. This code change ensures that the dsp is freed when we are finished with the frame. This change is very similar to a change Russell made with translators back a month or so ago. (closes issue #11999) Reported by: destiny6628 Patches: 11999.patch uploaded by putnopvut (license 60) Tested by: destiny6628, victoryure git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@114207 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main')
-rw-r--r--main/dsp.c33
-rw-r--r--main/frame.c3
2 files changed, 35 insertions, 1 deletions
diff --git a/main/dsp.c b/main/dsp.c
index 4ec1a8265..3caf65027 100644
--- a/main/dsp.c
+++ b/main/dsp.c
@@ -1486,6 +1486,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
memset(&dsp->f, 0, sizeof(dsp->f));
dsp->f.frametype = AST_FRAME_NULL;
ast_frfree(af);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
if ((dsp->features & DSP_FEATURE_BUSY_DETECT) && ast_dsp_busydetect(dsp)) {
@@ -1494,7 +1495,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
dsp->f.frametype = AST_FRAME_CONTROL;
dsp->f.subclass = AST_CONTROL_BUSY;
ast_frfree(af);
- ast_log(LOG_DEBUG, "Requesting Hangup because the busy tone was detected on channel %s\n", chan->name);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
if ((dsp->features & DSP_FEATURE_DTMF_DETECT)) {
@@ -1516,6 +1517,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
if (chan)
ast_queue_frame(chan, af);
ast_frfree(af);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
} else {
@@ -1542,6 +1544,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
ast_queue_frame(chan, af);
ast_frfree(af);
}
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
} else {
memset(&dsp->f, 0, sizeof(dsp->f));
@@ -1559,6 +1562,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
if (chan)
ast_queue_frame(chan, af);
ast_frfree(af);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
}
@@ -1575,6 +1579,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
if (chan)
ast_queue_frame(chan, af);
ast_frfree(af);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
} else {
@@ -1588,6 +1593,7 @@ struct ast_frame *ast_dsp_process(struct ast_channel *chan, struct ast_dsp *dsp,
if (chan)
ast_queue_frame(chan, af);
ast_frfree(af);
+ ast_set_flag(&dsp->f, AST_FRFLAG_FROM_DSP);
return &dsp->f;
}
}
@@ -1658,6 +1664,17 @@ void ast_dsp_set_features(struct ast_dsp *dsp, int features)
void ast_dsp_free(struct ast_dsp *dsp)
{
+ if (ast_test_flag(&dsp->f, AST_FRFLAG_FROM_DSP)) {
+ /* If this flag is still set, that means that the dsp's destruction
+ * been torn down, while we still have a frame out there being used.
+ * When ast_frfree() gets called on that frame, this ast_trans_pvt
+ * will get destroyed, too. */
+
+ /* Set the magic hint that this has been requested to be destroyed. */
+ dsp->freqcount = -1;
+
+ return;
+ }
free(dsp);
}
@@ -1786,3 +1803,17 @@ int ast_dsp_get_tcount(struct ast_dsp *dsp)
{
return dsp->tcount;
}
+
+void ast_dsp_frame_freed(struct ast_frame *fr)
+{
+ struct ast_dsp *dsp;
+
+ ast_clear_flag(fr, AST_FRFLAG_FROM_DSP);
+
+ dsp = (struct ast_dsp *) (((char *) fr) - offsetof(struct ast_dsp, f));
+
+ if (dsp->freqcount != -1)
+ return;
+
+ ast_dsp_free(dsp);
+}
diff --git a/main/frame.c b/main/frame.c
index 5c4613f4d..d2240efb0 100644
--- a/main/frame.c
+++ b/main/frame.c
@@ -321,6 +321,8 @@ void ast_frame_free(struct ast_frame *fr, int cache)
{
if (ast_test_flag(fr, AST_FRFLAG_FROM_TRANSLATOR))
ast_translate_frame_freed(fr);
+ else if (ast_test_flag(fr, AST_FRFLAG_FROM_DSP))
+ ast_dsp_frame_freed(fr);
if (!fr->mallocd)
return;
@@ -370,6 +372,7 @@ struct ast_frame *ast_frisolate(struct ast_frame *fr)
void *newdata;
ast_clear_flag(fr, AST_FRFLAG_FROM_TRANSLATOR);
+ ast_clear_flag(fr, AST_FRFLAG_FROM_DSP);
if (!(fr->mallocd & AST_MALLOCD_HDR)) {
/* Allocate a new header if needed */