From 41b956fd2442e1f9ef3cbec7ad8332dfb2ab4cb8 Mon Sep 17 00:00:00 2001 From: Stefan Knoblich Date: Thu, 1 Sep 2011 01:35:01 +0200 Subject: [PATCH] FreeTDM: Don't ftdm_safe_free() span information in ftdm_span_destroy() if span provides a custom span_destroy callback. Doing so will cause a NULL-deref segfault while removing the current span from the global hash (cur_span->name == NULL) in ftdm_global_destroy(). Remove all the ftdm_safe_free() calls in the custom callback part of ftdm_span_destroy() and let ftdm_global_destroy() handle that. NOTE: Also adds a missing ftdm_safe_free(cur_span->dtmf_hangup) to ftdm_global_destroy(). Signed-off-by: Stefan Knoblich --- libs/freetdm/src/ftdm_io.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libs/freetdm/src/ftdm_io.c b/libs/freetdm/src/ftdm_io.c index 0205ab36b1..e190becd35 100644 --- a/libs/freetdm/src/ftdm_io.c +++ b/libs/freetdm/src/ftdm_io.c @@ -649,9 +649,6 @@ static ftdm_status_t ftdm_span_destroy(ftdm_span_t *span) if (span->fio->span_destroy(span) != FTDM_SUCCESS) { status = FTDM_FAIL; } - ftdm_safe_free(span->type); - ftdm_safe_free(span->name); - ftdm_safe_free(span->dtmf_hangup); } /* destroy final basic resources of the span data structure */ @@ -5774,6 +5771,7 @@ FT_DECLARE(ftdm_status_t) ftdm_global_destroy(void) } hashtable_remove(globals.span_hash, (void *)cur_span->name); + ftdm_safe_free(cur_span->dtmf_hangup); ftdm_safe_free(cur_span->type); ftdm_safe_free(cur_span->name); ftdm_safe_free(cur_span);