<HTML>
<HEAD>
<TITLE>Switch_core_get_variable</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'><BR>
I found a hole in the way we handle core variables in FS. Switch_core_get_variable does the lookup and returns the found pointer. In Switch_core_set_variable the first step it does is look up the variable and free it (if it exists). This would free it out from under another that has just done a get on it. This is how I stumbled on this. <BR>
<BR>
Is the right fix is to add a switch_core_get_variable_dup that dups the string while in the mutex protection? I realize in the core case this will require the caller to then free the returned memory, but this is better than getting a bad pointer. This is analogous to the switch_channel_get_variable and it’s _dup implementation, although it dups it to session memory.<BR>
<BR>
Switch_channel_get_variable’s ability to peak through to the core variables is susceptible to this. If a core variable is changed after switch_channel_get_variable looks it up but before it dups to the session pool, it’ll have a bad pointer. <BR>
<BR>
Kevin Snow<BR>
Ooma, Inc</SPAN></FONT>
</BODY>
</HTML>