From 78d7d93acd76305fe117dec0d627a306a7257d3f Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Thu, 20 Mar 2025 07:33:10 -0400 Subject: [PATCH] MT#55283 fix array indexing Entries can be removed within the loop Change-Id: I173849591edd36ee3eac50087a5768966af98000 --- daemon/media_socket.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/daemon/media_socket.c b/daemon/media_socket.c index 0f362bec5..316777c9b 100644 --- a/daemon/media_socket.c +++ b/daemon/media_socket.c @@ -1639,7 +1639,8 @@ static const char *kernelize_target(kernelize_state *s, struct packet_stream *st s->payload_types->pdata[i++] = rs; t_ptr_array_sort(s->payload_types, __rtp_stats_pt_sort); - for (i = 0; i < num_pts; i++) { + i = 0; + while (i < num_pts) { if (reti->num_payload_types >= G_N_ELEMENTS(reti->pt_stats)) { ilog(LOG_WARNING | LOG_FLAG_LIMIT, "Too many RTP payload types for kernel module"); break; @@ -1670,13 +1671,16 @@ static const char *kernelize_target(kernelize_state *s, struct packet_stream *st // ensure that the final list in *payload_types reflects the payload // types populated in reti->payload_types t_ptr_array_remove_index(s->payload_types, i); + num_pts--; continue; } - reti->pt_stats[reti->num_payload_types] = rs; - reti->num_payload_types++; + reti->pt_stats[i] = rs; + i++; } + reti->num_payload_types = num_pts; + return NULL; }