Merged revisions 51829 via svnmerge from
authorRussell Bryant <russell@russellbryant.com>
Wed, 24 Jan 2007 00:21:32 +0000 (00:21 +0000)
committerRussell Bryant <russell@russellbryant.com>
Wed, 24 Jan 2007 00:21:32 +0000 (00:21 +0000)
https://origsvn.digium.com/svn/asterisk/branches/1.4

................
r51829 | russell | 2007-01-23 18:19:55 -0600 (Tue, 23 Jan 2007) | 12 lines

Merged revisions 51828 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2

........
r51828 | russell | 2007-01-23 18:17:50 -0600 (Tue, 23 Jan 2007) | 4 lines

Don't set a new value for the END_ variable on the channel before using the
old value.  If you do, it will lead to accessing a memory address that has
been free()'d.  (issue #8895, arkadia)

........

................

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@51830 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_while.c

index 33f9bbb..8595916 100644 (file)
@@ -231,8 +231,8 @@ static int _while_exec(struct ast_channel *chan, void *data, int end)
                pbx_builtin_setvar_helper(chan, my_name, NULL);
                snprintf(end_varname,VAR_SIZE,"END_%s",varname);
                if ((goto_str=pbx_builtin_getvar_helper(chan, end_varname))) {
-                       pbx_builtin_setvar_helper(chan, end_varname, NULL);
                        ast_parseable_goto(chan, goto_str);
+                       pbx_builtin_setvar_helper(chan, end_varname, NULL);
                } else {
                        int pri = find_matching_endwhile(chan);
                        if (pri > 0) {