]> git.ipfire.org Git - thirdparty/freeswitch.git/commit
[mod_sofia] Fix use-after-free in dispatch event thread. (#3031)
authorDmitry Verenitsin <morbit85@gmail.com>
Mon, 25 May 2026 21:15:19 +0000 (02:15 +0500)
committerGitHub <noreply@github.com>
Mon, 25 May 2026 21:15:19 +0000 (00:15 +0300)
commit08c3fffa7cf6596a25f564d747fa7c28424a368c
treeabba16bd0a6d6fea727aedf3ba948525f362709e
parent56cc958b2877317506eb674ea87b7720a3ca6b43
[mod_sofia] Fix use-after-free in dispatch event thread. (#3031)

`sofia_process_dispatch_event_in_thread` allocated `td` from a memory pool,
then `sofia_msg_thread_run_once` destroyed that same pool after processing
the event — leaving `td` dangling when the thread pool worker accessed it.

Allocate `td` with `switch_zmalloc` (`td->alloc = 1`) so the worker frees it
safely after the function returns. Remove the now-unused `pool` field from
`sofia_dispatch_event_t`.
src/mod/endpoints/mod_sofia/mod_sofia.h
src/mod/endpoints/mod_sofia/sofia.c