Index: main/dsp.c
===================================================================
--- main/dsp.c (revision 114105)
+++ main/dsp.c (working copy)
@@ -1495,7 +1495,12 @@
dsp->f.subclass = AST_CONTROL_BUSY;
ast_frfree(af);
ast_log(LOG_DEBUG, "Requesting Hangup because the busy tone was detected on channel %s\n", chan->name);
- return &dsp->f;
+ /* When ast_read() is called to get a frame from a channel, if we get an AST_CONTROL_BUSY frame, the reaction
+ * will be to hang up the channel and then later free the frame. The problem is that hanging up the channel
+ * will mean freeing the dsp, which means that dsp->f is now invalid memory to reference. So, instead of
+ * passing a reference to it specifically, we duplicate the frame and pass it instead.
+ */
+ return ast_frdup(&dsp->f);
}
if ((dsp->features & DSP_FEATURE_DTMF_DETECT)) {
digit = __ast_dsp_digitdetect(dsp, shortdata, len, &writeback);