Can't use items duplicated off the stack frame in an element returned from

a function: in these cases, we have to use the heap, or garbage will result.
(closes issue #13898)
 Reported by: alecdavis
 Patches: 
       20081114__bug13898__2.diff.txt uploaded by Corydon76 (license 14)
 Tested by: alecdavis


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@157253 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_dial.c

@@ -1170,7 +1170,7 @@ static int do_timelimit(struct ast_channel *chan, struct ast_bridge_config *conf
 		play_to_caller = 1;
 
 	var = pbx_builtin_getvar_helper(chan, "LIMIT_WARNING_FILE");
-	config->warning_sound = !ast_strlen_zero(var) ? ast_strdupa(var) : "timeleft";
+	config->warning_sound = !ast_strlen_zero(var) ? ast_strdup(var) : ast_strdup("timeleft");
 
 	/* The code looking at config wants a NULL, not just "", to decide
 	 * that the message should not be played, so we replace "" with NULL.
@@ -1179,10 +1179,10 @@ static int do_timelimit(struct ast_channel *chan, struct ast_bridge_config *conf
 	 */
 
 	var = pbx_builtin_getvar_helper(chan, "LIMIT_TIMEOUT_FILE");
-	config->end_sound = !ast_strlen_zero(var) ? ast_strdupa(var) : NULL;
+	config->end_sound = !ast_strlen_zero(var) ? ast_strdup(var) : NULL;
 
 	var = pbx_builtin_getvar_helper(chan, "LIMIT_CONNECT_FILE");
-	config->start_sound = !ast_strlen_zero(var) ? ast_strdupa(var) : NULL;
+	config->start_sound = !ast_strlen_zero(var) ? ast_strdup(var) : NULL;
 
 	ast_channel_unlock(chan);
 
@@ -2264,6 +2264,15 @@ out:
 	}
 
 done:
+	if (config.warning_sound) {
+		ast_free((char *)config.warning_sound);
+	}
+	if (config.end_sound) {
+		ast_free((char *)config.end_sound);
+	}
+	if (config.start_sound) {
+		ast_free((char *)config.start_sound);
+	}
 	return res;
 }