res_fax: Resolve T38 gateway frame leak.

When frames are translated by a fax gateway they need to be freed.  The
existing call to ast_frfree was unreachable.  This change reorganizes
fax_gateway_framehook to ensure that ast_frfree is called when needed.

ASTERISK-24457 #close
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/4115/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@426527 65c4cc65-6c06-0410-ace0-fbb531ad65f3

res/res_fax.c

@@ -3129,26 +3129,26 @@ static struct ast_frame *fax_gateway_framehook(struct ast_channel *chan, struct
 
 	/* in gateway mode, gateway some packets */
 	if (gateway->t38_state == T38_STATE_NEGOTIATED) {
+		struct ast_trans_pvt *readtrans;
 		/* framehooks are called in __ast_read() before frame format
 		 * translation is done, so we need to translate here */
-		if ((f->frametype == AST_FRAME_VOICE) && (f->subclass.format.id != AST_FORMAT_SLINEAR)) {
-			if (ast_channel_readtrans(active) && (f = ast_translate(ast_channel_readtrans(active), f, 1)) == NULL) {
+		if ((f->frametype == AST_FRAME_VOICE) && (f->subclass.format.id != AST_FORMAT_SLINEAR)
+			&& (readtrans = ast_channel_readtrans(active))) {
+			if ((f = ast_translate(readtrans, f, 1)) == NULL) {
 				f = &ast_null_frame;
 				ao2_ref(details, -1);
 				return f;
 			}
-		}
-
 			/* XXX we ignore the return value here, perhaps we should
 			 * disable the gateway if a write fails. I am not sure how a
 			 * write would fail, or even if a failure would be fatal so for
 			 * now we'll just ignore the return value. */
 			gateway->s->tech->write(gateway->s, f);
-		if ((f->frametype == AST_FRAME_VOICE) && (f->subclass.format.id != AST_FORMAT_SLINEAR) && ast_channel_readtrans(active)) {
-			/* Only free the frame if we translated / duplicated it - otherwise,
-			 * let whatever is outside the frame hook do it */
 			ast_frfree(f);
+		} else {
+			gateway->s->tech->write(gateway->s, f);
 		}
+
 		f = &ast_null_frame;
 		ao2_ref(details, -1);
 		return f;