fix memory issue in spandsp_tone_detect

diff --git a/src/mod/applications/mod_fifo/mod_fifo.c b/src/mod/applications/mod_fifo/mod_fifo.c
index 1984406effe59321f16ccc22b481ba8082fe4bb8..bd94a71afa050cad49a31fbfbd755378b2489545 100644 (file)
--- a/src/mod/applications/mod_fifo/mod_fifo.c
+++ b/src/mod/applications/mod_fifo/mod_fifo.c
@@ -489,6 +489,19 @@ struct fifo_chime_data {
 
 typedef struct fifo_chime_data fifo_chime_data_t;
 
+static switch_status_t chime_read_frame_callback(switch_core_session_t *session, switch_frame_t *frame, void *user_data)
+{
+       fifo_chime_data_t *cd = (fifo_chime_data_t *) user_data;
+
+       if (cd && cd->orbit_timeout && switch_epoch_time_now(NULL) >= cd->orbit_timeout) {
+               cd->do_orbit = 1;
+               return SWITCH_STATUS_BREAK;
+       }
+       
+       return SWITCH_STATUS_SUCCESS;
+}
+
+
 static switch_status_t caller_read_frame_callback(switch_core_session_t *session, switch_frame_t *frame, void *user_data)
 {
        fifo_chime_data_t *cd = (fifo_chime_data_t *) user_data;
@@ -510,6 +523,8 @@ static switch_status_t caller_read_frame_callback(switch_core_session_t *session
                        args.input_callback = moh_on_dtmf;
                        args.buf = buf;
                        args.buflen = sizeof(buf);
+                       args.read_frame_callback = chime_read_frame_callback;
+                       args.user_data = user_data;
 
                        if (switch_ivr_play_file(session, NULL, cd->list[cd->index], &args) != SWITCH_STATUS_SUCCESS) {
                                return SWITCH_STATUS_BREAK;
@@ -522,10 +537,10 @@ static switch_status_t caller_read_frame_callback(switch_core_session_t *session
                        cd->next = switch_epoch_time_now(NULL) + cd->freq;
                        cd->index++;
                }
-       } else if (cd->orbit_timeout && switch_epoch_time_now(NULL) >= cd->orbit_timeout) {
-               cd->do_orbit = 1;
-               return SWITCH_STATUS_BREAK;
+       } else {
+               chime_read_frame_callback(session, frame, user_data);
        }
+       
 
        return SWITCH_STATUS_SUCCESS;
 }

diff --git a/src/mod/applications/mod_spandsp/mod_spandsp_dsp.c b/src/mod/applications/mod_spandsp/mod_spandsp_dsp.c
index b31f6e15f1170d85d52987faea2bb1150ffab296..f7387b9e8d42269db373e503c6b7c44188d48b70 100644 (file)
--- a/src/mod/applications/mod_spandsp/mod_spandsp_dsp.c
+++ b/src/mod/applications/mod_spandsp/mod_spandsp_dsp.c
@@ -173,7 +173,7 @@ static globals_t globals;
  */
 
 #define MAX_TONES 32
-
+#define STRLEN 128
 /**
  * Tone descriptor
  *
@@ -187,7 +187,9 @@ struct tone_descriptor {
        super_tone_rx_descriptor_t *spandsp_tone_descriptor;
 
        /** The mapping of tone id to key */
-       const char *tone_keys[MAX_TONES];
+       char tone_keys[MAX_TONES][STRLEN];
+    int idx;
+
 };
 typedef struct tone_descriptor tone_descriptor_t;
 
@@ -256,7 +258,11 @@ static int tone_descriptor_add_tone(tone_descriptor_t *descriptor, const char *k
        if (id >= MAX_TONES) {
                return -1;
        }
-       descriptor->tone_keys[id] = key; 
+       switch_set_string(descriptor->tone_keys[id], key);
+
+    if (id > descriptor->idx) {
+        descriptor->idx = id;
+    }
 
        return id;
 }
@@ -358,7 +364,8 @@ static switch_bool_t tone_detector_process_buffer(tone_detector_t *detector, voi
 {
        detector->detected_tone = -1;
        super_tone_rx(detector->spandsp_detector, data, len);
-       if (detector->detected_tone != -1) {
+
+       if (detector->detected_tone > -1 && detector->detected_tone < detector->descriptor->idx && detector->detected_tone < MAX_TONES) {
                *key = detector->descriptor->tone_keys[detector->detected_tone];
                return SWITCH_TRUE;
        }