Don't crash when destroying chan_dahdi pseudo channels.

Must do a deep copy of the cc_params in duplicate_pseudo().  Otherwise,
when the duplicate pseudo channel is destroyed, it frees the original
pseudo channel cc_params.  The original pseudo channel is then left with a
dangling pointer for when the next duplicated pseudo channel is created.

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@262743 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 601c6ef..51e64ee 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -12427,6 +12427,15 @@ static struct dahdi_pvt *duplicate_pseudo(struct dahdi_pvt *src)
                return NULL;
        }
        *p = *src;
+
+       /* Must deep copy the cc_params. */
+       p->cc_params = ast_cc_config_params_init();
+       if (!p->cc_params) {
+               ast_free(p);
+               return NULL;
+       }
+       ast_cc_copy_config_params(p->cc_params, src->cc_params);
+
        p->which_iflist = DAHDI_IFLIST_NONE;
        p->next = NULL;
        p->prev = NULL;
@@ -17559,7 +17568,7 @@ static void deep_copy_dahdi_chan_conf(struct dahdi_chan_conf *dest, const struct
        struct ast_cc_config_params *cc_params;
 
        cc_params = dest->chan.cc_params;
-       memcpy(dest, src, sizeof(dest));
+       *dest = *src;
        dest->chan.cc_params = cc_params;
        ast_cc_copy_config_params(dest->chan.cc_params, src->chan.cc_params);
 }