[asterisk-bugs] [JIRA] (ASTERISK-27238) Bridging: Crash freeing a frame that's already been freed

[Richard Kenner (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-27238?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=238940#comment-238940 ] 

Richard Kenner commented on ASTERISK-27238:
-------------------------------------------

I just did a bit of archeology.  I should have remembered this earlier, but the code in question is very new: it was added as the fix for ASTERISK-26926, which I also reported.   So only people who would have run into that bug will run into this one.  But that change is clearly incorrect: audiohook_list_translate_to_slin can return its operand unchanged, which is start_frame, and then it returns the frame it just freed.  So it now seems to me that my patch above is actually the correct patch.  I would also recommend changing "return frame" a few lines above to "return start_frame"; they're both equal, but the latter is more consistent with the rest of the code (which doesn't use "frame" anymore) and makes it easier to read.


> Bridging: Crash freeing a frame that's already been freed
> ---------------------------------------------------------
>
>                 Key: ASTERISK-27238
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27238
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/Bridging
>    Affects Versions: 14.6.0
>         Environment: Centos 7
>            Reporter: Richard Kenner
>            Assignee: Unassigned
>         Attachments: confbridge.conf, traceback.txt, valgrind.txt
>
>
> See traceback.txt traceback.  The frame being freed is below:
> {noformat}
> $2 = {frametype = AST_FRAME_VOICE, subclass = {integer = 0, 
>     format = 0x24bc940, frame_ending = 0}, datalen = 0, samples = 320, 
>   mallocd = 1, mallocd_hdr_len = 545, offset = 64, 
>   src = 0x7f554c00c7a8 "func_jitterbuffer interpolation", data = {ptr = 0x0, 
>     uint32 = 0, pad = "\000\000\000\000\000\000\000"}, delivery = {
>     tv_sec = 1504146592, tv_usec = 647484}, frame_list = {
>     next = 0x7f5544002de0}, flags = 0, ts = 0, len = 0, seqno = 0}
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)