FreeTDM: Don't ftdm_safe_free() span information in ftdm_span_destroy() if span provi...

Doing so will cause a NULL-deref segfault while removing the current span from the
global hash (cur_span->name == NULL) in ftdm_global_destroy().

Remove all the ftdm_safe_free() calls in the custom callback part of ftdm_span_destroy() and
let ftdm_global_destroy() handle that.

NOTE: Also adds a missing ftdm_safe_free(cur_span->dtmf_hangup) to ftdm_global_destroy().

Signed-off-by: Stefan Knoblich <stkn@openisdn.net>

diff --git a/libs/freetdm/src/ftdm_io.c b/libs/freetdm/src/ftdm_io.c
index 0205ab36b1836bdcaea4db1fdd630a7f53f21da9..e190becd350d0c9feae86aef126c45b3e94d630e 100644 (file)
--- a/libs/freetdm/src/ftdm_io.c
+++ b/libs/freetdm/src/ftdm_io.c
@@ -649,9 +649,6 @@ static ftdm_status_t ftdm_span_destroy(ftdm_span_t *span)
                if (span->fio->span_destroy(span) != FTDM_SUCCESS) {
                        status = FTDM_FAIL;
                }
-               ftdm_safe_free(span->type);
-               ftdm_safe_free(span->name);
-               ftdm_safe_free(span->dtmf_hangup);
        }
 
        /* destroy final basic resources of the span data structure */
@@ -5774,6 +5771,7 @@ FT_DECLARE(ftdm_status_t) ftdm_global_destroy(void)
                        }
 
                        hashtable_remove(globals.span_hash, (void *)cur_span->name);
+                       ftdm_safe_free(cur_span->dtmf_hangup);
                        ftdm_safe_free(cur_span->type);
                        ftdm_safe_free(cur_span->name);
                        ftdm_safe_free(cur_span);