From f3b85fface2bea9dd5cae5dcc5546ff34c1566cb Mon Sep 17 00:00:00 2001 From: Sean Bright Date: Wed, 3 Jun 2009 20:39:10 +0000 Subject: [PATCH] Fix a possible crash in pbx_spool. We were trying to reference members of a struct that had previously been freed. This patch makes sure that we free the struct after it has been removed from the spooler queue. (closes issue #15072) Reported by: garlew Patches: spool.diff uploaded by garlew (license 376) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@198957 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- pbx/pbx_spool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pbx/pbx_spool.c b/pbx/pbx_spool.c index 8c8880d72b..3ab4e83854 100644 --- a/pbx/pbx_spool.c +++ b/pbx/pbx_spool.c @@ -419,20 +419,20 @@ static int scan_service(char *fn, time_t now, time_t atime) return now; } else { ast_log(LOG_EVENT, "Queued call to %s/%s expired without completion after %d attempt%s\n", o->tech, o->dest, o->retries - 1, ((o->retries - 1) != 1) ? "s" : ""); - free_outgoing(o); remove_from_queue(o, "Expired"); + free_outgoing(o); return 0; } } else { - free_outgoing(o); ast_log(LOG_WARNING, "Invalid file contents in %s, deleting\n", fn); fclose(f); remove_from_queue(o, "Failed"); + free_outgoing(o); } } else { - free_outgoing(o); ast_log(LOG_WARNING, "Unable to open %s: %s, deleting\n", fn, strerror(errno)); remove_from_queue(o, "Failed"); + free_outgoing(o); } } else ast_log(LOG_WARNING, "Out of memory :(\n"); -- 2.47.2