[svn-commits] dvossel: branch 1.6.2 r219521 - in /branches/1.6.2: ./ channels/chan_iax2.c

[SVN commits to the Digium repositories]

Author: dvossel
Date: Fri Sep 18 18:21:41 2009
New Revision: 219521

URL: http://svn.asterisk.org/svn-view/asterisk?view=rev&rev=219521
Log:
Merged revisions 219520 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r219520 | dvossel | 2009-09-18 18:20:58 -0500 (Fri, 18 Sep 2009) | 15 lines
  
  Merged revisions 219519 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r219519 | dvossel | 2009-09-18 18:19:50 -0500 (Fri, 18 Sep 2009) | 9 lines
    
    iax2 frame double free
    
    The iax frame's retrans sched id was written over right
    before iax2_frame_free was called.  In iax2_frame_free that
    retrans id is used to delete the sched item.  By writing over
    the retrans field before the sched item could be deleted, it was
    possible for a retransmit to occur on a freed frame.
  ........
................

Modified:
    branches/1.6.2/   (props changed)
    branches/1.6.2/channels/chan_iax2.c

Propchange: branches/1.6.2/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.2/channels/chan_iax2.c
URL: http://svn.asterisk.org/svn-view/asterisk/branches/1.6.2/channels/chan_iax2.c?view=diff&rev=219521&r1=219520&r2=219521
==============================================================================
--- branches/1.6.2/channels/chan_iax2.c (original)
+++ branches/1.6.2/channels/chan_iax2.c Fri Sep 18 18:21:41 2009
@@ -1640,6 +1640,7 @@
 static void iax2_frame_free(struct iax_frame *fr)
 {
 	ast_sched_thread_del(sched, fr->retrans);
+	fr->retrans = -1;
 	iax_frame_free(fr);
 }
 
@@ -3311,7 +3312,6 @@
 		AST_LIST_LOCK(&frame_queue);
 		AST_LIST_REMOVE(&frame_queue, f, list);
 		AST_LIST_UNLOCK(&frame_queue);
-		f->retrans = -1;
 		/* Free the IAX frame */
 		iax2_frame_free(f);
 	}