[asterisk-speech-rec] Double free failure in handle_speechrecognize function of res_agi.c

[Raymond Menard]

Problem found in Asterisk 1.6.1.12 and up

 

In the handle_speechrecognize function, if speech frames stop coming in
(e.g. because of silence suppression), the previously received frame is
freed twice because the fr field is not cleared after the first free.

 

Asterisk blows up in GLIBC with double free message.

 

Attached patch done with 1.6.1.16

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-speech-rec/attachments/20100222/56a79462/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DOUBLE_FREE_RES_AGI.patch
Type: application/octet-stream
Size: 250 bytes
Desc: not available
Url : http://lists.digium.com/pipermail/asterisk-speech-rec/attachments/20100222/56a79462/attachment.obj