From ca032d1e2e31ff865f8e9acb0f80769b868dd1a8 Mon Sep 17 00:00:00 2001 From: Pirmin Walthert Date: Tue, 14 Apr 2020 17:31:15 +0200 Subject: [PATCH] res_rtp_asterisk: Free payload when error on insertion to data buffer When the ast_data_buffer_put rejects to add a packet, for example because the buffer already contains a packet with the same sequence number, the payload will never be freed, resulting in a memory leak. The data buffer will now return an error if this situation occurs allowing the caller to free the payload. The res_rtp_asterisk module has also been updated to do this. ASTERISK-28826 Change-Id: Ie6c49495d1c921d5f997651c7d0f79646f095cf1 --- main/data_buffer.c | 2 +- res/res_rtp_asterisk.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/main/data_buffer.c b/main/data_buffer.c index cfc323c680..85e79711c4 100644 --- a/main/data_buffer.c +++ b/main/data_buffer.c @@ -254,7 +254,7 @@ int ast_data_buffer_put(struct ast_data_buffer *buffer, size_t pos, void *payloa AST_LIST_TRAVERSE_SAFE_END; if (inserted == -1) { - return 0; + return -1; } if (!inserted) { diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c index 4fc42177ce..5dd5d355f1 100644 --- a/res/res_rtp_asterisk.c +++ b/res/res_rtp_asterisk.c @@ -4991,7 +4991,9 @@ static int rtp_raw_write(struct ast_rtp_instance *instance, struct ast_frame *fr if (payload) { payload->size = packet_len; memcpy(payload->buf, rtpheader, packet_len); - ast_data_buffer_put(rtp->send_buffer, rtp->seqno, payload); + if (ast_data_buffer_put(rtp->send_buffer, rtp->seqno, payload) == -1) { + ast_free(payload); + } } } @@ -7938,7 +7940,9 @@ static struct ast_frame *ast_rtp_read(struct ast_rtp_instance *instance, int rtc payload->size = res; memcpy(payload->buf, rtpheader, res); - ast_data_buffer_put(rtp->recv_buffer, seqno, payload); + if (ast_data_buffer_put(rtp->recv_buffer, seqno, payload) == -1) { + ast_free(payload); + } /* If this sequence number is removed that means we had a gap and this packet has filled it in * some. Since it was part of the gap we will have already added any other missing sequence numbers