[sr-dev] git:master:18a3a5aa: ims_usrloc_scscf: fixed derefenrecing of already freed subscription

[jaybeepee]

Module: kamailio
Branch: master
Commit: 18a3a5aa66434b995d51c85d016da0092b0c6c41
URL: https://github.com/kamailio/kamailio/commit/18a3a5aa66434b995d51c85d016da0092b0c6c41

Author: jaybeepee <jason.penton at gmail.com>
Committer: jaybeepee <jason.penton at gmail.com>
Date: 2016-09-26T13:21:10+02:00

ims_usrloc_scscf: fixed derefenrecing of already freed subscription

---

Modified: modules/ims_usrloc_scscf/impurecord.c

---

Diff:  https://github.com/kamailio/kamailio/commit/18a3a5aa66434b995d51c85d016da0092b0c6c41.diff
Patch: https://github.com/kamailio/kamailio/commit/18a3a5aa66434b995d51c85d016da0092b0c6c41.patch

---

diff --git a/modules/ims_usrloc_scscf/impurecord.c b/modules/ims_usrloc_scscf/impurecord.c
index 8485e56..908b76a 100644
--- a/modules/ims_usrloc_scscf/impurecord.c
+++ b/modules/ims_usrloc_scscf/impurecord.c
@@ -362,7 +362,7 @@ static inline void process_impurecord(impurecord_t* _r) {
     ucontact_t* ptr;
     int hascontacts;
     udomain_t* _d;
-    reg_subscriber *s;
+    reg_subscriber *s, *next;
     subs_t* sub_dialog;
     int dbwork = 0;
 
@@ -371,6 +371,7 @@ static inline void process_impurecord(impurecord_t* _r) {
     s = _r->shead;
     LM_DBG("Checking validity of IMPU: <%.*s> registration subscriptions\n", _r->public_identity.len, _r->public_identity.s);
     while (s) {
+		next = s->next;
         if (!valid_subscriber(s, act_time)) {
             LM_DBG("DBG:registrar_timer: Subscriber with watcher_contact <%.*s> and presentity uri <%.*s> expired and removed.\n",
                     s->watcher_contact.len, s->watcher_contact.s, s->presentity_uri.len, s->presentity_uri.s);
@@ -397,7 +398,7 @@ static inline void process_impurecord(impurecord_t* _r) {
             lock_release(&sub_dialog_table[sl].lock);
             mustdeleteimpu = 0;
         }
-        s = s->next;
+        s = next;
     }
 
     LM_DBG("\tPublic Identity %.*s, Barred: [%d], State: [%s]\n",