Browse Source

dialog(k): reset the pointer value after free

- otherwise may result in double free, reported by Alex Balashov
Daniel-Constantin Mierla 15 years ago
parent
commit
4e196f4776
1 changed files with 10 additions and 2 deletions
  1. 10 2
      modules_k/dialog/dlg_hash.c

+ 10 - 2
modules_k/dialog/dlg_hash.c

@@ -297,8 +297,16 @@ int dlg_set_leg_info(struct dlg_cell *dlg, str* tag, str *rr, str *contact,
 	dlg->cseq[leg].s = (char*)shm_malloc( cseq->len );
 	if ( dlg->tag[leg].s==NULL || dlg->cseq[leg].s==NULL) {
 		LM_ERR("no more shm mem\n");
-		if (dlg->tag[leg].s) shm_free(dlg->tag[leg].s);
-		if (dlg->cseq[leg].s) shm_free(dlg->cseq[leg].s);
+		if (dlg->tag[leg].s)
+		{
+			shm_free(dlg->tag[leg].s);
+			dlg->tag[leg].s = NULL;
+		}
+		if (dlg->cseq[leg].s)
+		{
+			shm_free(dlg->cseq[leg].s);
+			dlg->cseq[leg].s = NULL;
+		}
 		return -1;
 	}
 	p = dlg->tag[leg].s;