sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

res_rtp_asterisk: Fix crash on ast_rtp_new failure. 

ast_rtp_new free'd rtp upon failure, but rtp_engine.c would also call
the destroy callback.  Remove call to ast_free from ast_rtp_new, leave
it to rtp_engine.c to initiate the full cleanup.  Add error detection
for the ssrc_mapping vector initialization.  In rtp_allocate_transport
set rtp->s = -1 in the failure path where we close that FD to ensure we
don't try closing it twice.

ASTERISK-27854 #close

Change-Id: Ie02aecbb46228ca804e24b19cec2bb6f7b94e451
This commit is contained in:
Corey Farrell 2018-09-21 11:19:52 -04:00
parent dec6ebd9e1
commit 7a7b21f3a0
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
res/res_rtp_asterisk.c
View File

@ -3504,6 +3504,7 @@ static int rtp_allocate_transport(struct ast_rtp_instance *instance, struct ast_
if (x == startplace || (errno != EADDRINUSE && errno != EACCES)) {
ast_log(LOG_ERROR, "Oh dear... we couldn't allocate a port for RTP instance '%p'\n", instance);
close(rtp->s);
rtp->s = -1;
return -1;
}
}
@ -3650,7 +3651,10 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
ast_rtp_instance_set_data(instance, rtp);
if (rtp_allocate_transport(instance, rtp)) {
ast_free(rtp);
return -1;
}
if (AST_VECTOR_INIT(&rtp->ssrc_mapping, 1)) {
return -1;
}
@ -3658,7 +3662,6 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
rtp->lastrxformat = ao2_bump(ast_format_none);
rtp->lasttxformat = ao2_bump(ast_format_none);
rtp->stream_num = -1;
AST_VECTOR_INIT(&rtp->ssrc_mapping, 1);
return 0;
}