don't access freed memory if the frame was malloc'd
authorKevin P. Fleming <kpfleming@digium.com>
Thu, 1 Sep 2005 19:34:49 +0000 (19:34 +0000)
committerKevin P. Fleming <kpfleming@digium.com>
Thu, 1 Sep 2005 19:34:49 +0000 (19:34 +0000)
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@6484 65c4cc65-6c06-0410-ace0-fbb531ad65f3

res/res_musiconhold.c

index a964717..540b9ef 100755 (executable)
@@ -241,18 +241,19 @@ static int moh_files_generator(struct ast_channel *chan, void *data, int len, in
        struct moh_files_state *state = chan->music_state;
        struct ast_frame *f = NULL;
        int res = 0;
        struct moh_files_state *state = chan->music_state;
        struct ast_frame *f = NULL;
        int res = 0;
+
        state->sample_queue += samples;
 
        while (state->sample_queue > 0) {
                if ((f = moh_files_readframe(chan))) {
                        state->samples += f->samples;
                        res = ast_write(chan, f);
        state->sample_queue += samples;
 
        while (state->sample_queue > 0) {
                if ((f = moh_files_readframe(chan))) {
                        state->samples += f->samples;
                        res = ast_write(chan, f);
+                       state->sample_queue -= f->samples;
                        ast_frfree(f);
                        if (res < 0) {
                                ast_log(LOG_WARNING, "Failed to write frame to '%s': %s\n", chan->name, strerror(errno));
                                return -1;
                        }
                        ast_frfree(f);
                        if (res < 0) {
                                ast_log(LOG_WARNING, "Failed to write frame to '%s': %s\n", chan->name, strerror(errno));
                                return -1;
                        }
-                       state->sample_queue -= f->samples;
                } else
                        return -1;      
        }
                } else
                        return -1;      
        }