From: Richard Mudgett <rmudgett@digium.com>
Date: Thu, 31 Mar 2011 20:11:40 +0000 (+0000)
Subject: chan_misdn segfaults when DEBUG_THREADS is enabled.
X-Git-Tag: 1.8.5-rc1~11^2~250
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=32e0a3510c0c9f636d9e6cf94cfc4dfd6270f598;p=thirdparty%2Fasterisk.git

chan_misdn segfaults when DEBUG_THREADS is enabled.

The segfault happens because jb->mutexjb is uninitialized from the
ast_malloc().  The internals of ast_mutex_init() were assuming a nonzero
value meant mutex tracking initialization had already happened.  Recent
changes to mutex tracking code to reduce excessive memory consumption
exposed this uninitialized value.

Converted misdn_jb_init() to use ast_calloc() instead of ast_malloc().
Also eliminated redundant zero initialization code in the routine.

(closes issue #18975)
Reported by: irroot


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@312022 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_misdn.c b/channels/chan_misdn.c
index b4bc942572..eb6e9bd5da 100644
--- a/channels/chan_misdn.c
+++ b/channels/chan_misdn.c
@@ -12432,29 +12432,28 @@ int chan_misdn_jb_empty(struct misdn_bchannel *bc, char *buf, int len)
 /* allocates the jb-structure and initialize the elements*/
 struct misdn_jb *misdn_jb_init(int size, int upper_threshold)
 {
-	int i;
 	struct misdn_jb *jb;
 
-	jb = ast_malloc(sizeof(*jb));
+	jb = ast_calloc(1, sizeof(*jb));
 	if (!jb) {
 	    chan_misdn_log(-1, 0, "No free Mem for jb\n");
 	    return NULL;
 	}
 	jb->size = size;
 	jb->upper_threshold = upper_threshold;
-	jb->wp = 0;
-	jb->rp = 0;
-	jb->state_full = 0;
-	jb->state_empty = 0;
-	jb->bytes_wrote = 0;
-	jb->samples = ast_malloc(size * sizeof(char));
+	//jb->wp = 0;
+	//jb->rp = 0;
+	//jb->state_full = 0;
+	//jb->state_empty = 0;
+	//jb->bytes_wrote = 0;
+	jb->samples = ast_calloc(size, sizeof(*jb->samples));
 	if (!jb->samples) {
 		ast_free(jb);
 		chan_misdn_log(-1, 0, "No free Mem for jb->samples\n");
 		return NULL;
 	}
 
-	jb->ok = ast_malloc(size * sizeof(char));
+	jb->ok = ast_calloc(size, sizeof(*jb->ok));
 	if (!jb->ok) {
 		ast_free(jb->samples);
 		ast_free(jb);
@@ -12462,10 +12461,6 @@ struct misdn_jb *misdn_jb_init(int size, int upper_threshold)
 		return NULL;
 	}
 
-	for (i = 0; i < size; i++) {
-		jb->ok[i] = 0;
-	}
-
 	ast_mutex_init(&jb->mutexjb);
 
 	return jb;