[asterisk-commits] seanbright: branch 1.4 r198957 - /branches/1.4/pbx/pbx_spool.c

[SVN commits to the Asterisk project]

Author: seanbright
Date: Wed Jun  3 15:39:10 2009
New Revision: 198957

URL: http://svn.asterisk.org/svn-view/asterisk?view=rev&rev=198957
Log:
Fix a possible crash in pbx_spool.

We were trying to reference members of a struct that had previously been freed.
This patch makes sure that we free the struct after it has been removed from
the spooler queue.

(closes issue #15072)
Reported by: garlew
Patches:
      spool.diff uploaded by garlew (license 376)

Modified:
    branches/1.4/pbx/pbx_spool.c

Modified: branches/1.4/pbx/pbx_spool.c
URL: http://svn.asterisk.org/svn-view/asterisk/branches/1.4/pbx/pbx_spool.c?view=diff&rev=198957&r1=198956&r2=198957
==============================================================================
--- branches/1.4/pbx/pbx_spool.c (original)
+++ branches/1.4/pbx/pbx_spool.c Wed Jun  3 15:39:10 2009
@@ -419,20 +419,20 @@
 					return now;
 				} else {
 					ast_log(LOG_EVENT, "Queued call to %s/%s expired without completion after %d attempt%s\n", o->tech, o->dest, o->retries - 1, ((o->retries - 1) != 1) ? "s" : "");
+					remove_from_queue(o, "Expired");
 					free_outgoing(o);
-					remove_from_queue(o, "Expired");
 					return 0;
 				}
 			} else {
-				free_outgoing(o);
 				ast_log(LOG_WARNING, "Invalid file contents in %s, deleting\n", fn);
 				fclose(f);
 				remove_from_queue(o, "Failed");
+				free_outgoing(o);
 			}
 		} else {
-			free_outgoing(o);
 			ast_log(LOG_WARNING, "Unable to open %s: %s, deleting\n", fn, strerror(errno));
 			remove_from_queue(o, "Failed");
+			free_outgoing(o);
 		}
 	} else
 		ast_log(LOG_WARNING, "Out of memory :(\n");