FS-12025: [mod_spandsp] FreeSWITCH crashes on reloadxml when spandsp tone detection is running.

src/mod/applications/mod_spandsp/mod_spandsp.c

@@ -485,7 +485,7 @@ static void destroy_descriptor(void *ptr)
 {
     tone_descriptor_t *d = (tone_descriptor_t *) ptr;
 
-    super_tone_rx_free_descriptor(d->spandsp_tone_descriptor);
+	tone_descriptor_destroy(d);
 }
 
 switch_status_t load_configuration(switch_bool_t reload)

src/mod/applications/mod_spandsp/mod_spandsp.h

@@ -133,6 +133,7 @@ typedef struct tone_descriptor tone_descriptor_t;
 
 
 switch_status_t tone_descriptor_create(tone_descriptor_t **descriptor, const char *name, switch_memory_pool_t *memory_pool);
+void tone_descriptor_destroy(tone_descriptor_t *descriptor);
 int tone_descriptor_add_tone(tone_descriptor_t *descriptor, const char *name);
 switch_status_t tone_descriptor_add_tone_element(tone_descriptor_t *descriptor, int tone_id, int freq1, int freq2, int min, int max);
 

src/mod/applications/mod_spandsp/mod_spandsp_dsp.c

@@ -637,6 +637,20 @@ switch_status_t tone_descriptor_create(tone_descriptor_t **descriptor, const cha
 	return SWITCH_STATUS_SUCCESS;
 }
 
+/**
+ * Destroy the tone descriptor
+ *
+ * @param descriptor the descriptor to create
+ * @return void
+ */
+void tone_descriptor_destroy(tone_descriptor_t *descriptor)
+{
+	if (descriptor->spandsp_tone_descriptor) {
+		super_tone_rx_free_descriptor(descriptor->spandsp_tone_descriptor);
+		descriptor->spandsp_tone_descriptor = NULL;
+	}
+}
+
 /**
  * Add a tone to the tone descriptor
  *
@@ -711,6 +725,48 @@ static void tone_segment_callback(void *user_data, int f1, int f2, int duration)
 	}
 }
 
+/**
+ * Duplicate the tone descriptor
+ *
+ * @param descriptor the descriptor to use
+ * @param memory_pool the pool to use
+ * @return pointer to a copy of descriptor
+ */
+static tone_descriptor_t *tone_descriptor_dup(tone_descriptor_t *descriptor, switch_memory_pool_t *pool)
+{
+	tone_descriptor_t *desc = NULL;
+	int t = 0, s = 0, tone_count = 0;
+
+	if (descriptor && pool) {
+		if (tone_descriptor_create(&desc, descriptor->name, pool) != SWITCH_STATUS_SUCCESS) {
+			return NULL;
+		}
+
+		tone_count = descriptor->idx + 1;
+
+		for (t = 0; t < tone_count; t++) {
+			int tone_id = tone_descriptor_add_tone(desc, descriptor->tone_keys[t]);
+			if (-1 != tone_id) {
+				int step = descriptor->spandsp_tone_descriptor->tone_segs[tone_id];
+				for (s = 0; s < step; s++) {
+					super_tone_rx_segment_t segment = descriptor->spandsp_tone_descriptor->tone_list[tone_id][s];
+					int f1 = (segment.f1 == -1 ? 0 : descriptor->spandsp_tone_descriptor->pitches[segment.f1][0]);
+					int f2 = (segment.f2 == -1 ? 0 : descriptor->spandsp_tone_descriptor->pitches[segment.f2][0]);
+					int min = segment.min_duration / 8;
+					int max = (segment.max_duration == 0x7FFFFFFF ? 0 : segment.max_duration / 8);
+					tone_descriptor_add_tone_element(desc, tone_id, f1, f2, min, max);
+				}
+			} else {
+				tone_descriptor_destroy(desc);
+				desc = NULL;
+				break;
+			}
+		}
+	}
+
+	return desc;
+}
+
 /**
  * Allocate the tone detector
  *
@@ -723,11 +779,8 @@ static void tone_segment_callback(void *user_data, int f1, int f2, int duration)
 static switch_status_t tone_detector_create(switch_core_session_t *session, tone_detector_t **detector, tone_descriptor_t *descriptor)
 {
 	tone_detector_t *ldetector = switch_core_session_alloc(session, sizeof(tone_detector_t));
-	tone_descriptor_t *desc = switch_core_session_alloc(session, sizeof(tone_descriptor_t));
-
-	memcpy(desc, descriptor, sizeof(tone_descriptor_t));
 
-	ldetector->descriptor = desc;
+	ldetector->descriptor = tone_descriptor_dup(descriptor, switch_core_session_get_pool(session));
 	ldetector->debug = spandsp_globals.tonedebug;
 	ldetector->session = session;
 	*detector = ldetector;
@@ -777,6 +830,10 @@ static void tone_detector_destroy(tone_detector_t *detector)
 			super_tone_rx_free(detector->spandsp_detector);
 			detector->spandsp_detector = NULL;
 		}
+		if (detector->descriptor) {
+			tone_descriptor_destroy(detector->descriptor);
+			detector->descriptor = NULL;
+		}
 	}
 }