Browse Source

TT#14008 fix possible use-after-free

Change-Id: I454d07f339e689bbc349ffef774ded6ef163e985
(cherry picked from commit aae30a4f72)
mr10.3
Richard Fuchs 4 years ago
parent
commit
2cd78b33da
1 changed files with 5 additions and 0 deletions
  1. +5
    -0
      daemon/codec.c

+ 5
- 0
daemon/codec.c View File

@ -1555,6 +1555,9 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
return 0;
}
// save RTP pointer - we clobber it below XXX this shouldn't be necessary to do
struct rtp_header *orig_rtp = mp->rtp;
packet->p.seq = ntohs(mp->rtp->seq_num);
packet->payload = str_dup(&mp->payload);
uint32_t packet_ts = ntohl(mp->rtp->timestamp);
@ -1697,6 +1700,8 @@ out_ch:
if (ch)
obj_put(&ch->h);
mp->rtp = orig_rtp;
return 0;
}


Loading…
Cancel
Save