Index: main/frame.c =================================================================== --- main/frame.c (revision 244242) +++ main/frame.c (working copy) @@ -300,6 +300,10 @@ if ((frames = ast_threadstorage_get(&frame_cache, sizeof(*frames)))) { if ((f = AST_LIST_REMOVE_HEAD(&frames->list, frame_list))) { size_t mallocd_len = f->mallocd_hdr_len; + if (f->samples != -1) { + ast_log(LOG_ERROR, "Used frame in free list! Tossing.\n"); + return ast_frame_header_new(); + } memset(f, 0, sizeof(*f)); f->mallocd_hdr_len = mallocd_len; f->mallocd = AST_MALLOCD_HDR; @@ -325,9 +329,14 @@ struct ast_frame_cache *frames = data; struct ast_frame *f; - while ((f = AST_LIST_REMOVE_HEAD(&frames->list, frame_list))) + while ((f = AST_LIST_REMOVE_HEAD(&frames->list, frame_list))) { + if (f->samples != -1) { + ast_log(LOG_ERROR, "Used frame in free list! Not free'ing\n"); + continue; + } ast_free(f); - + } + ast_free(frames); } #endif @@ -345,7 +354,13 @@ if ((frames = ast_threadstorage_get(&frame_cache, sizeof(*frames))) && (frames->size < FRAME_CACHE_MAX_SIZE)) { + if (fr->samples == -1) { + ast_log(LOG_ERROR, "Frame already freed! Not storing.\n"); + ast_backtrace(); + return; + } AST_LIST_INSERT_HEAD(&frames->list, fr, frame_list); + fr->samples = -1; frames->size++; return; } @@ -490,6 +505,11 @@ #if !defined(LOW_MEMORY) if ((frames = ast_threadstorage_get(&frame_cache, sizeof(*frames)))) { AST_LIST_TRAVERSE_SAFE_BEGIN(&frames->list, out, frame_list) { + if (out->samples != -1) { + ast_log(LOG_ERROR, "Used frame in free list!\n"); + continue; + } + if (out->mallocd_hdr_len >= len) { size_t mallocd_len = out->mallocd_hdr_len;