From: Stefan Knoblich Date: Wed, 31 Aug 2011 23:35:01 +0000 (+0200) Subject: FreeTDM: Don't ftdm_safe_free() span information in ftdm_span_destroy() if span provi... X-Git-Tag: v1.2-rc1~51^2~186 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=41b956fd2442e1f9ef3cbec7ad8332dfb2ab4cb8;p=thirdparty%2Ffreeswitch.git FreeTDM: Don't ftdm_safe_free() span information in ftdm_span_destroy() if span provides a custom span_destroy callback. Doing so will cause a NULL-deref segfault while removing the current span from the global hash (cur_span->name == NULL) in ftdm_global_destroy(). Remove all the ftdm_safe_free() calls in the custom callback part of ftdm_span_destroy() and let ftdm_global_destroy() handle that. NOTE: Also adds a missing ftdm_safe_free(cur_span->dtmf_hangup) to ftdm_global_destroy(). Signed-off-by: Stefan Knoblich --- diff --git a/libs/freetdm/src/ftdm_io.c b/libs/freetdm/src/ftdm_io.c index 0205ab36b1..e190becd35 100644 --- a/libs/freetdm/src/ftdm_io.c +++ b/libs/freetdm/src/ftdm_io.c @@ -649,9 +649,6 @@ static ftdm_status_t ftdm_span_destroy(ftdm_span_t *span) if (span->fio->span_destroy(span) != FTDM_SUCCESS) { status = FTDM_FAIL; } - ftdm_safe_free(span->type); - ftdm_safe_free(span->name); - ftdm_safe_free(span->dtmf_hangup); } /* destroy final basic resources of the span data structure */ @@ -5774,6 +5771,7 @@ FT_DECLARE(ftdm_status_t) ftdm_global_destroy(void) } hashtable_remove(globals.span_hash, (void *)cur_span->name); + ftdm_safe_free(cur_span->dtmf_hangup); ftdm_safe_free(cur_span->type); ftdm_safe_free(cur_span->name); ftdm_safe_free(cur_span);