Commit 08c3fffa7c for freeswitch.com

commit 08c3fffa7cf6596a25f564d747fa7c28424a368c
Author: Dmitry Verenitsin <morbit85@gmail.com>
Date:   Tue May 26 02:15:19 2026 +0500

    [mod_sofia] Fix use-after-free in dispatch event thread. (#3031)

    `sofia_process_dispatch_event_in_thread` allocated `td` from a memory pool,
    then `sofia_msg_thread_run_once` destroyed that same pool after processing
    the event — leaving `td` dangling when the thread pool worker accessed it.

    Allocate `td` with `switch_zmalloc` (`td->alloc = 1`) so the worker frees it
    safely after the function returns. Remove the now-unused `pool` field from
    `sofia_dispatch_event_t`.

diff --git a/src/mod/endpoints/mod_sofia/mod_sofia.h b/src/mod/endpoints/mod_sofia/mod_sofia.h
index 8e2b1b483c..3689f82a20 100644
--- a/src/mod/endpoints/mod_sofia/mod_sofia.h
+++ b/src/mod/endpoints/mod_sofia/mod_sofia.h
@@ -168,7 +168,6 @@ typedef struct sofia_dispatch_event_s {
 	int save;
 	switch_core_session_t *session;
 	switch_core_session_t *init_session;
-	switch_memory_pool_t *pool;
 	struct sofia_dispatch_event_s *next;
 } sofia_dispatch_event_t;

diff --git a/src/mod/endpoints/mod_sofia/sofia.c b/src/mod/endpoints/mod_sofia/sofia.c
index 2901ffdd63..7579c8c03c 100644
--- a/src/mod/endpoints/mod_sofia/sofia.c
+++ b/src/mod/endpoints/mod_sofia/sofia.c
@@ -2199,22 +2199,15 @@ static uint32_t DE_THREAD_CNT = 0;
 void *SWITCH_THREAD_FUNC sofia_msg_thread_run_once(switch_thread_t *thread, void *obj)
 {
 	sofia_dispatch_event_t *de = (sofia_dispatch_event_t *) obj;
-	switch_memory_pool_t *pool = NULL;

 	switch_mutex_lock(mod_sofia_globals.mutex);
 	DE_THREAD_CNT++;
 	switch_mutex_unlock(mod_sofia_globals.mutex);

 	if (de) {
-		pool = de->pool;
-		de->pool = NULL;
 		sofia_process_dispatch_event(&de);
 	}

-	if (pool) {
-		switch_core_destroy_memory_pool(&pool);
-	}
-
 	switch_mutex_lock(mod_sofia_globals.mutex);
 	DE_THREAD_CNT--;
 	switch_mutex_unlock(mod_sofia_globals.mutex);
@@ -2225,16 +2218,12 @@ void *SWITCH_THREAD_FUNC sofia_msg_thread_run_once(switch_thread_t *thread, void
 void sofia_process_dispatch_event_in_thread(sofia_dispatch_event_t **dep)
 {
 	sofia_dispatch_event_t *de = *dep;
-	switch_memory_pool_t *pool;
-	//sofia_profile_t *profile = (*dep)->profile;
 	switch_thread_data_t *td;

-	switch_core_new_memory_pool(&pool);
-
 	*dep = NULL;
-	de->pool = pool;

-	td = switch_core_alloc(pool, sizeof(*td));
+	switch_zmalloc(td, sizeof(*td));
+	td->alloc = 1;
 	td->func = sofia_msg_thread_run_once;
 	td->obj = de;