Skip to content

[mod_sofia] use-after-free crash - ensure that sofia_private is cleared in all cases where the nh handle is destroyed (since it is allocated out of nh's memory pool). #3082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
creslin287 wants to merge 1 commit into
base: master
Choose a base branch
from
+3 −1
Open

[mod_sofia] use-after-free crash - ensure that sofia_private is cleared in all cases where the nh handle is destroyed (since it is allocated out of nh's memory pool). #3082

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/mod/endpoints/mod_sofia/mod_sofia.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -679,7 +679,7 @@ switch_status_t sofia_on_hangup(switch_core_session_t *session)

sofia_clear_flag(tech_pvt, TFLAG_IO);

if (tech_pvt->sofia_private) {
if (tech_pvt->nh && tech_pvt->sofia_private) {
/* set to NULL so that switch_core_session_locate no longer succeeds, but don't lose the UUID in uuid_str so we
* can fire events with session UUID */
tech_pvt->sofia_private->uuid = NULL;
Expand Down
2 changes: 2 additions & 0 deletions src/mod/endpoints/mod_sofia/sofia.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2161,6 +2161,8 @@ static void our_sofia_event_callback(nua_event_t event,

if (tech_pvt && (tech_pvt->nh == nh)) {
tech_pvt->nh = NULL;
/* Sofia private is allocated from nh's pool. If it will be destroyed, we need to clear it */
tech_pvt->sofia_private = NULL;
}

nua_handle_destroy(nh);
Expand Down