From: Terry Wilson <twilson@digium.com>
Date: Fri, 15 Oct 2010 02:13:17 +0000 (+0000)
Subject: Don't access o->next after freeing o on unload
X-Git-Tag: 1.4.38-rc1~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7922632617fd6b87e8299b48c3718d185b20af68;p=thirdparty%2Fasterisk.git

Don't access o->next after freeing o on unload


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@291862 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_oss.c b/channels/chan_oss.c
index f78046780f..026a63d445 100644
--- a/channels/chan_oss.c
+++ b/channels/chan_oss.c
@@ -1875,12 +1875,13 @@ static int load_module(void)
 
 static int unload_module(void)
 {
-	struct chan_oss_pvt *o;
+	struct chan_oss_pvt *o, *next;
 
 	ast_channel_unregister(&oss_tech);
 	ast_cli_unregister_multiple(cli_oss, sizeof(cli_oss) / sizeof(struct ast_cli_entry));
 
-	for (o = oss_default.next; o; o = o->next) {
+	o = oss_default.next;
+	while (o) {
 		if (o->owner) {
 			ast_softhangup(o->owner, AST_SOFTHANGUP_APPUNLOAD);
 			/* Give the channel a chance to go away */
@@ -1900,9 +1901,11 @@ static int unload_module(void)
 			close(o->sndcmd[0]);
 			close(o->sndcmd[1]);
 		}
+		next = o->next;
 		if (o->sthread > 0) {
-			free(o);
+			ast_free(o);
 		}
+		o = next;
 	}
 	return 0;
 }