[Core] Prevent write after free into heap when calling switch_core_destroy_memory_pool()

diff --git a/src/switch_core_memory.c b/src/switch_core_memory.c
index 86b54ce02e7a6d2d9243b0730a3266609a98bd37..3685956257bb4a1d180953e7f54a86dd79204291 100644 (file)
--- a/src/switch_core_memory.c
+++ b/src/switch_core_memory.c
@@ -465,38 +465,42 @@ SWITCH_DECLARE(switch_status_t) switch_core_perform_destroy_memory_pool(switch_m
 {
        char *tmp;
        const char *tag;
+       switch_memory_pool_t *tmp_pool = NULL;
        switch_assert(pool != NULL);
        
        /* In tag we store who calls the pool creation.
           Now we append it with who calls the pool destroy.
        */
        if (*pool) {
-               tag = apr_pool_tag(*pool, NULL);
-               tmp = switch_core_sprintf(*pool, "%s,%s:%d", (tag ? tag : ""), file, line);
-               apr_pool_tag(*pool, tmp);
+               tmp_pool = *pool;
+               *pool = NULL;
+
+               tag = apr_pool_tag(tmp_pool, NULL);
+               tmp = switch_core_sprintf(tmp_pool, "%s,%s:%d", (tag ? tag : ""), file, line);
+               apr_pool_tag(tmp_pool, tmp);
        }
 
 #ifdef DEBUG_ALLOC2
-       switch_log_printf(SWITCH_CHANNEL_ID_LOG, file, func, line, NULL, SWITCH_LOG_CONSOLE, "%p Free Pool %s\n", (void *) *pool, apr_pool_tag(*pool, NULL));
+       switch_log_printf(SWITCH_CHANNEL_ID_LOG, file, func, line, NULL, SWITCH_LOG_CONSOLE, "%p Free Pool %s\n", (void *) tmp_pool, apr_pool_tag(tmp_pool, NULL));
 #endif
 
 #ifdef INSTANTLY_DESTROY_POOLS
 #ifdef USE_MEM_LOCK
        switch_mutex_lock(memory_manager.mem_lock);
 #endif
-       apr_pool_destroy(*pool);
+       apr_pool_destroy(tmp_pool);
 #ifdef USE_MEM_LOCK
        switch_mutex_unlock(memory_manager.mem_lock);
 #endif
 #else
-       if ((memory_manager.pool_thread_running != 1) || (switch_queue_push(memory_manager.pool_queue, *pool) != SWITCH_STATUS_SUCCESS)) {
+       if ((memory_manager.pool_thread_running != 1) || (switch_queue_push(memory_manager.pool_queue, tmp_pool) != SWITCH_STATUS_SUCCESS)) {
 #ifdef USE_MEM_LOCK
                switch_mutex_lock(memory_manager.mem_lock);
 #endif
 #if APR_POOL_DEBUG
-               apr_pool_destroy_debug(*pool, func);
+               apr_pool_destroy_debug(tmp_pool, func);
 #else
-               apr_pool_destroy(*pool);
+               apr_pool_destroy(tmp_pool);
 #endif
 #ifdef USE_MEM_LOCK
                switch_mutex_unlock(memory_manager.mem_lock);
@@ -504,8 +508,6 @@ SWITCH_DECLARE(switch_status_t) switch_core_perform_destroy_memory_pool(switch_m
        }
 #endif
 
-       *pool = NULL;
-
        return SWITCH_STATUS_SUCCESS;
 }