From 8ded0076da67a98bc5a4d1c9fc198f985b6c27af Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Mon, 16 Nov 2020 11:45:46 -0500 Subject: [PATCH] TT#101202 fix potential null pointer dereference closes #1110 Change-Id: Ib5e26b40bc55e7c96b59a19ddd7ed6bec2d109db --- daemon/codec.c | 19 ++++++++++++------- daemon/media_socket.c | 2 +- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/daemon/codec.c b/daemon/codec.c index 353ba4681..c7f1704b7 100644 --- a/daemon/codec.c +++ b/daemon/codec.c @@ -1923,7 +1923,6 @@ static void __dtx_send_later(struct timerthread_queue *ttq, void *p) { struct transcode_packet *packet = dtxe->packet; struct media_packet *mp = &dtxe->mp; struct packet_stream *ps = mp->stream; - struct packet_stream *sink = ps->rtp_sink; int ret = 0; mutex_lock(&dtxb->lock); @@ -1982,13 +1981,19 @@ static void __dtx_send_later(struct timerthread_queue *ttq, void *p) { __ssrc_unlock_both(mp); if (mp->packets_out.length && ret == 0) { - if (ps->handler && media_packet_encrypt(ps->handler->out->rtp_crypt, sink, mp)) - ilog(LOG_ERR | LOG_FLAG_LIMIT, "Error encrypting buffered RTP media"); + struct packet_stream *sink = ps->rtp_sink; - mutex_lock(&sink->out_lock); - if (media_socket_dequeue(mp, sink)) - ilog(LOG_ERR | LOG_FLAG_LIMIT, "Error sending buffered media to RTP sink"); - mutex_unlock(&sink->out_lock); + if (!sink) + media_socket_dequeue(mp, NULL); // just free + else { + if (ps->handler && media_packet_encrypt(ps->handler->out->rtp_crypt, sink, mp)) + ilog(LOG_ERR | LOG_FLAG_LIMIT, "Error encrypting buffered RTP media"); + + mutex_lock(&sink->out_lock); + if (media_socket_dequeue(mp, sink)) + ilog(LOG_ERR | LOG_FLAG_LIMIT, "Error sending buffered media to RTP sink"); + mutex_unlock(&sink->out_lock); + } } rwlock_unlock_r(&call->master_lock); diff --git a/daemon/media_socket.c b/daemon/media_socket.c index d7612d7ca..a2367da35 100644 --- a/daemon/media_socket.c +++ b/daemon/media_socket.c @@ -1784,7 +1784,7 @@ out: int media_socket_dequeue(struct media_packet *mp, struct packet_stream *sink) { struct codec_packet *p; while ((p = g_queue_pop_head(&mp->packets_out))) { - if (sink->send_timer) + if (sink && sink->send_timer) send_timer_push(sink->send_timer, p); else codec_packet_free(p);