fix memory issue in spandsp_tone_detect

src/mod/applications/mod_fifo/mod_fifo.c

@@ -489,6 +489,19 @@ struct fifo_chime_data {
 
 typedef struct fifo_chime_data fifo_chime_data_t;
 
+static switch_status_t chime_read_frame_callback(switch_core_session_t *session, switch_frame_t *frame, void *user_data)
+{
+	fifo_chime_data_t *cd = (fifo_chime_data_t *) user_data;
+
+	if (cd && cd->orbit_timeout && switch_epoch_time_now(NULL) >= cd->orbit_timeout) {
+		cd->do_orbit = 1;
+		return SWITCH_STATUS_BREAK;
+	}
+	
+	return SWITCH_STATUS_SUCCESS;
+}
+
+
 static switch_status_t caller_read_frame_callback(switch_core_session_t *session, switch_frame_t *frame, void *user_data)
 {
 	fifo_chime_data_t *cd = (fifo_chime_data_t *) user_data;
@@ -510,6 +523,8 @@ static switch_status_t caller_read_frame_callback(switch_core_session_t *session
 			args.input_callback = moh_on_dtmf;
 			args.buf = buf;
 			args.buflen = sizeof(buf);
+			args.read_frame_callback = chime_read_frame_callback;
+			args.user_data = user_data;
 
 			if (switch_ivr_play_file(session, NULL, cd->list[cd->index], &args) != SWITCH_STATUS_SUCCESS) {
 				return SWITCH_STATUS_BREAK;
@@ -522,10 +537,10 @@ static switch_status_t caller_read_frame_callback(switch_core_session_t *session
 			cd->next = switch_epoch_time_now(NULL) + cd->freq;
 			cd->index++;
 		}
-	} else if (cd->orbit_timeout && switch_epoch_time_now(NULL) >= cd->orbit_timeout) {
-		cd->do_orbit = 1;
-		return SWITCH_STATUS_BREAK;
+	} else {
+		chime_read_frame_callback(session, frame, user_data);
 	}
+	
 
 	return SWITCH_STATUS_SUCCESS;
 }

src/mod/applications/mod_spandsp/mod_spandsp_dsp.c

@@ -173,7 +173,7 @@ static globals_t globals;
  */
 
 #define MAX_TONES 32
-
+#define STRLEN 128
 /**
  * Tone descriptor
  *
@@ -187,7 +187,9 @@ struct tone_descriptor {
 	super_tone_rx_descriptor_t *spandsp_tone_descriptor;
 
 	/** The mapping of tone id to key */
-	const char *tone_keys[MAX_TONES];
+	char tone_keys[MAX_TONES][STRLEN];
+    int idx;
+
 };
 typedef struct tone_descriptor tone_descriptor_t;
 
@@ -256,7 +258,11 @@ static int tone_descriptor_add_tone(tone_descriptor_t *descriptor, const char *k
 	if (id >= MAX_TONES) {
 		return -1;
 	}
-	descriptor->tone_keys[id] = key; 
+	switch_set_string(descriptor->tone_keys[id], key);
+
+    if (id > descriptor->idx) {
+        descriptor->idx = id;
+    }
 
 	return id;
 }
@@ -358,7 +364,8 @@ static switch_bool_t tone_detector_process_buffer(tone_detector_t *detector, voi
 {
 	detector->detected_tone = -1;
 	super_tone_rx(detector->spandsp_detector, data, len);
-	if (detector->detected_tone != -1) {
+
+	if (detector->detected_tone > -1 && detector->detected_tone < detector->descriptor->idx && detector->detected_tone < MAX_TONES) {
 		*key = detector->descriptor->tone_keys[detector->detected_tone];
 		return SWITCH_TRUE;
 	}