From: William King <william.king@quentustech.com>
Date: Sun, 15 Sep 2013 23:19:19 +0000 (-0700)
Subject: How did the use after free not blowup in the last 3 years since it was modified?
X-Git-Tag: v1.5.6~125^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b91d6e430af611f0d4fd0067b64786d2c1041390;p=thirdparty%2Ffreeswitch.git

How did the use after free not blowup in the last 3 years since it was modified?
---

diff --git a/src/mod/applications/mod_fifo/mod_fifo.c b/src/mod/applications/mod_fifo/mod_fifo.c
index 7c236ef6d2..1affefa3e4 100644
--- a/src/mod/applications/mod_fifo/mod_fifo.c
+++ b/src/mod/applications/mod_fifo/mod_fifo.c
@@ -1637,7 +1637,6 @@ static void *SWITCH_THREAD_FUNC o_thread_run(switch_thread_t *thread, void *obj)
 	fifo_execute_sql_queued(&sql, SWITCH_TRUE, SWITCH_TRUE);
 
 	status = switch_ivr_originate(NULL, &session, &cause, originate_string, h->timeout, NULL, NULL, NULL, NULL, ovars, SOF_NONE, NULL);
-	free(originate_string);
 
 	if (status != SWITCH_STATUS_SUCCESS) {
 
@@ -1694,6 +1693,10 @@ static void *SWITCH_THREAD_FUNC o_thread_run(switch_thread_t *thread, void *obj)
 
   end:
 
+	if ( originate_string ){
+		switch_safe_free(originate_string);
+	}
+
 	switch_event_destroy(&ovars);
 	if (node) {
 		switch_mutex_lock(node->update_mutex);