瀏覽代碼

parser/sdp: Fixed double free

- Found and fixed by Hugh Waite @ Crocodile RCS
Peter Dunkley 12 年之前
父節點
當前提交
8ec3068861
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      parser/sdp/sdp.c

+ 2 - 2
parser/sdp/sdp.c

@@ -665,8 +665,7 @@ static int parse_mixed_content(str *mixed_body, str delimiter, sdp_info_t* _sdp)
 			/* LM_DBG("we need to check session %d: <%.*s>\n", session_num, _sdp.raw_sdp.len, _sdp.raw_sdp.s); */
 			res = parse_sdp_session(&_sdp->raw_sdp, session_num, &cnt_disp, _sdp);
 			if (res != 0) {
-				LM_DBG("free_sdp\n");
-				free_sdp((sdp_info_t**)(void*)&(_sdp));
+				/* _sdp is freed by the calling function */
 				return -1;
 			}
 			session_num++;
@@ -746,6 +745,7 @@ int parse_sdp(struct sip_msg* _m)
 				}
 				res = parse_mixed_content(&body, mp_delimiter, (sdp_info_t*)_m->body);
 				if (res != 0) {
+					LM_DBG("free_sdp\n");
 					free_sdp((sdp_info_t**)(void*)&_m->body);
 				}
 				return res;