[Asterisk-code-review] res ari events: Fix use after free / double-free of JSON mes... (asterisk[15])

[Joshua Colp]

Joshua Colp has submitted this change and it was merged. ( https://gerrit.asterisk.org/7048 )

Change subject: res_ari_events: Fix use after free / double-free of JSON message.
......................................................................

res_ari_events: Fix use after free / double-free of JSON message.

When stasis_app_message_handler needs to queue a message for a later
connection it needs to bump the message reference so it doesn't get
freed when the caller releases it's reference.

Change-Id: I82696df8fe723b3365c15c3f7089501da8daa892
---
M res/ari/resource_events.c
1 file changed, 3 insertions(+), 1 deletion(-)

Approvals:
  George Joseph: Looks good to me, but someone else must approve
  Joshua Colp: Looks good to me, but someone else must approve; Approved for Submit
  Richard Mudgett: Looks good to me, approved



diff --git a/res/ari/resource_events.c b/res/ari/resource_events.c
index 4be5d02..992c562 100644
--- a/res/ari/resource_events.c
+++ b/res/ari/resource_events.c
@@ -108,7 +108,9 @@
 		        msg_application);
 	} else if (!session->ws_session) {
 		/* If the websocket is NULL, the message goes to the queue */
-		AST_VECTOR_APPEND(&session->message_queue, message);
+		if (!AST_VECTOR_APPEND(&session->message_queue, message)) {
+			ast_json_ref(message);
+		}
 		ast_log(LOG_WARNING,
 				"Queued '%s' message for Stasis app '%s'; websocket is not ready\n",
 				msg_type,

-- 
To view, visit https://gerrit.asterisk.org/7048
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 15
Gerrit-MessageType: merged
Gerrit-Change-Id: I82696df8fe723b3365c15c3f7089501da8daa892
Gerrit-Change-Number: 7048
Gerrit-PatchSet: 2
Gerrit-Owner: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Jenkins2
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-Reviewer: Richard Mudgett <rmudgett at digium.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20171107/077452f0/attachment.html>