From 8675791e9e39158eb87cd275c4bd1efce0b8d143 Mon Sep 17 00:00:00 2001 From: mmichelson Date: Sun, 1 Mar 2009 21:45:08 +0000 Subject: Properly free memory and remove scheduler entries when a transmission failure occurs. Previously, only the "data" field of the sip_pkt created during __sip_reliable_xmit was freed when XMIT_ERROR was returned by __sip_xmit. When retrans_pkt was called, this inevitably resulted in the reading and writing of freed memory. XMIT_ERROR is a condition meaning that we don't want to attempt resending the packet at all. The proper action to take is to remove the scheduler entry we just created, free the packet's data as well as the packet itself, and unlink it from the list of packets on the sip_pvt structure. (closes issue #14455) Reported by: Nick_Lewis Patches: 14455.patch uploaded by mmichelson (license 60) Tested by: Nick_Lewis git-svn-id: http://svn.digium.com/svn/asterisk/trunk@179219 f38db490-d61c-443f-a65b-d21fe96a405b --- channels/chan_sip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'channels') diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 693ee34e5..3a6362a6d 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -3581,8 +3581,10 @@ static enum sip_result __sip_reliable_xmit(struct sip_pvt *p, int seqno, int res if (xmitres == XMIT_ERROR) { /* Serious network trouble, no need to try again */ append_history(pkt->owner, "XmitErr", "%s", pkt->is_fatal ? "(Critical)" : "(Non-critical)"); ast_log(LOG_ERROR, "Serious Network Trouble; __sip_xmit returns error for pkt data\n"); - if (pkt->data) - ast_free(pkt->data); + AST_SCHED_DEL(sched, pkt->retransid); + p->packets = pkt->next; + ast_free(pkt->data); + ast_free(pkt); return AST_FAILURE; } else { return AST_SUCCESS; -- cgit v1.2.3