[asterisk-commits] mjordan: branch 11 r396961 - in /branches/11: ./ main/data.c

[SVN commits to the Asterisk project]

Author: mjordan
Date: Mon Aug 19 20:18:34 2013
New Revision: 396961

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=396961
Log:
Fix invalid access to disposed memory in main/data unit test

It is not safe to iterate over a macro'd list of ao2 objects, deref them such
that the item's destructor is called, and leave them in the list. The list
macro to iterate over items requires the item to be a valid allocated object
in order to proceed to the next item; with MALLOC_DEBUG on the corruption of
the linked list is caught in the crash.

This patch fixes the invalid access to free'd memory by removing the ao2 item
from the list before de-refing it.

Note that this is a backport of r396915 from Asterisk trunk.
........

Merged revisions 396958 from http://svn.asterisk.org/svn/asterisk/branches/1.8

Modified:
    branches/11/   (props changed)
    branches/11/main/data.c

Propchange: branches/11/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.

Modified: branches/11/main/data.c
URL: http://svnview.digium.com/svn/asterisk/branches/11/main/data.c?view=diff&rev=396961&r1=396960&r2=396961
==============================================================================
--- branches/11/main/data.c (original)
+++ branches/11/main/data.c Mon Aug 19 20:18:34 2013
@@ -1631,7 +1631,7 @@
 {
 	struct data_filter *filter = obj, *globres;
 
-	AST_LIST_TRAVERSE(&(filter->glob_list), globres, list) {
+	while ((globres = AST_LIST_REMOVE_HEAD(&(filter->glob_list), list))) {
 		ao2_ref(globres, -1);
 	}