[Asterisk-Dev] Bug in el_end() ??

[Matt Lawson]

Hi everyone,

I found a potential bug in el_end().  Asterisk died with this stack trace:

gdb) bt
#0  0x400208fe in pthread_mutex_lock () from /lib/libpthread.so.0
#1  0x4017426c in free () from /lib/libc.so.6
#2  0x0808f5fc in el_end ()
#3  0x08081352 in main ()
#4  0x08081669 in main ()
#5  0x401319c8 in sigaction () from /lib/libc.so.6
#6  0x08091882 in el_push ()
#7  0x08091922 in el_getc ()
#8  0x08091791 in el_push ()
#9  0x08091a51 in el_gets ()
#10 0x08080642 in main ()
#11 0x40120a51 in __libc_start_main () from /lib/libc.so.6

When I looked at el_end() (in editline/el.c) , I noticed that it doesn't 
check el->prog before freeing it (even though it does check el, which 
presumably "should" mean that it's OK...)

Whaddya think?

- Matt