diff options
| author | zuul <zuul@gerrit.asterisk.org> | 2016-11-02 01:21:45 -0500 |
|---|---|---|
| committer | Gerrit Code Review <gerrit2@gerrit.digium.api> | 2016-11-02 01:21:45 -0500 |
| commit | bff5c2742636b6e93b57da56fbafeedde2902c7e (patch) | |
| tree | b5a955004f388fba05e7c7a8955e702b3c97906b /third-party/pjproject/patches | |
| parent | de2c964e8671531ba70844cc302eb2bf1d4aa603 (diff) | |
| parent | f29b8d62bb39767ecef2859c79cea3f6c0d1c3c2 (diff) | |
Merge "bundled pjproject: Fix DNS write to freed memory."
Diffstat (limited to 'third-party/pjproject/patches')
| -rw-r--r-- | third-party/pjproject/patches/0006-r5477-svn-backport-Fix-DNS-write-on-freed-memory.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/third-party/pjproject/patches/0006-r5477-svn-backport-Fix-DNS-write-on-freed-memory.patch b/third-party/pjproject/patches/0006-r5477-svn-backport-Fix-DNS-write-on-freed-memory.patch new file mode 100644 index 000000000..f70dd45e7 --- /dev/null +++ b/third-party/pjproject/patches/0006-r5477-svn-backport-Fix-DNS-write-on-freed-memory.patch @@ -0,0 +1,33 @@ +From 732a997010d60fe93a7453e809672386749b0afc Mon Sep 17 00:00:00 2001 +From: Richard Mudgett <rmudgett@digium.com> +Date: Tue, 1 Nov 2016 12:55:31 -0500 +Subject: [PATCH] r5477 svn backport Fix DNS write on freed memory. + +Re #1974: Fix DNS write on freed memory. +Thanks to Richard Mudgett for the patch. +--- + pjlib-util/src/pjlib-util/resolver.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/pjlib-util/src/pjlib-util/resolver.c b/pjlib-util/src/pjlib-util/resolver.c +index 52b7655..365772e 100644 +--- a/pjlib-util/src/pjlib-util/resolver.c ++++ b/pjlib-util/src/pjlib-util/resolver.c +@@ -908,7 +908,13 @@ PJ_DEF(pj_status_t) pj_dns_resolver_start_query( pj_dns_resolver *resolver, + /* Must return PJ_SUCCESS */ + status = PJ_SUCCESS; + +- goto on_return; ++ /* ++ * We cannot write to *p_query after calling cb because what ++ * p_query points to may have been freed by cb. ++ * Refer to ticket #1974. ++ */ ++ pj_mutex_unlock(resolver->mutex); ++ return status; + } + + /* At this point, we have a cached entry, but this entry has expired. +-- +1.7.9.5 + |