[asterisk-commits] dvossel: branch 1.4 r219519 - /branches/1.4/channels/chan_iax2.c

[SVN commits to the Asterisk project]

Author: dvossel
Date: Fri Sep 18 18:19:50 2009
New Revision: 219519

URL: http://svn.asterisk.org/svn-view/asterisk?view=rev&rev=219519
Log:
iax2 frame double free

The iax frame's retrans sched id was written over right
before iax2_frame_free was called.  In iax2_frame_free that
retrans id is used to delete the sched item.  By writing over
the retrans field before the sched item could be deleted, it was
possible for a retransmit to occur on a freed frame.


Modified:
    branches/1.4/channels/chan_iax2.c

Modified: branches/1.4/channels/chan_iax2.c
URL: http://svn.asterisk.org/svn-view/asterisk/branches/1.4/channels/chan_iax2.c?view=diff&rev=219519&r1=219518&r2=219519
==============================================================================
--- branches/1.4/channels/chan_iax2.c (original)
+++ branches/1.4/channels/chan_iax2.c Fri Sep 18 18:19:50 2009
@@ -3064,7 +3064,6 @@
 		AST_LIST_REMOVE(&iaxq.queue, f, list);
 		iaxq.count--;
 		AST_LIST_UNLOCK(&iaxq.queue);
-		f->retrans = -1;
 		/* Free the IAX frame */
 		iax2_frame_free(f);
 	}