[asterisk-speech-rec] Double free failure in handle_speechrecognize function of res_agi.c

[Raymond Menard]

Resubmit patch redone in "unified output format" (diff -u) instead of
"context output format" (diff -c)

 

From: asterisk-speech-rec-bounces at lists.digium.com
[mailto:asterisk-speech-rec-bounces at lists.digium.com] On Behalf Of Raymond
Menard
Sent: February 22, 2010 2:56 PM
To: asterisk-speech-rec at lists.digium.com
Subject: [asterisk-speech-rec] Double free failure in
handle_speechrecognize function of res_agi.c

 

Problem found in Asterisk 1.6.1.12 and up

 

In the handle_speechrecognize function, if speech frames stop coming in
(e.g. because of silence suppression), the previously received frame is
freed twice because the fr field is not cleared after the first free.

 

Asterisk blows up in GLIBC with double free message.

 

Attached patch done with 1.6.1.16

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-speech-rec/attachments/20100222/8a10e873/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DOUBLE_FREE_RES_AGI.patch
Type: application/octet-stream
Size: 211 bytes
Desc: not available
Url : http://lists.digium.com/pipermail/asterisk-speech-rec/attachments/20100222/8a10e873/attachment.obj