From bd039ad94d2bd020add85ebe41a91c9ad2dbbb6d Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Fri, 3 Nov 2023 15:08:02 -0400 Subject: [PATCH] MT#55283 fix use-after-free Grab the correct list link when inserting in the middle of the list. Change-Id: I4ae484ba05f5e4be827101193952653c21c47ad3 (cherry picked from commit 3f5a22d2a53f0e2cb6e9577c8cde89e6d7411c62) --- daemon/codec.c | 9 +- t/auto-daemon-tests.pl | 219 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 225 insertions(+), 3 deletions(-) diff --git a/daemon/codec.c b/daemon/codec.c index 43564f7b7..c9f453154 100644 --- a/daemon/codec.c +++ b/daemon/codec.c @@ -4807,11 +4807,14 @@ static void codec_store_add_raw_link(struct codec_store *cs, struct rtp_payload_ STR_FMT(&pt->encoding_with_full_params), link); g_hash_table_insert(cs->codecs, GINT_TO_POINTER(pt->payload_type), pt); __rtp_payload_type_add_name(cs->codec_names, pt); - if (!link) + if (!link) { g_queue_push_tail(&cs->codec_prefs, pt); - else + pt->prefs_link = cs->codec_prefs.tail; + } + else { g_queue_insert_before(&cs->codec_prefs, link, pt); - pt->prefs_link = cs->codec_prefs.tail; + pt->prefs_link = link->prev; + } if (!cs->supp_link && pt->codec_def && pt->codec_def->supplemental) cs->supp_link = pt->prefs_link; } diff --git a/t/auto-daemon-tests.pl b/t/auto-daemon-tests.pl index 30175a0be..33005ed99 100755 --- a/t/auto-daemon-tests.pl +++ b/t/auto-daemon-tests.pl @@ -82,6 +82,225 @@ sub stun_succ { +new_call; + +offer('codec reneg control', { + ptime => 20, 'ptime-reverse' => 20, ICE => 'force', flags => [qw(no-codec-renegotiation + generate-mid generate-rtcp port-latching SDES-off codec-strip-telephone-event + codec-strip-opus codec-strip-G729 codec-strip-G729a codec-strip-speex + codec-strip-G723 codec-strip-GSM codec-strip-iLBC codec-mask-G722 codec-mask-PCMA + codec-mask-PCMU transcode-opus codec-offer-telephone-event)], + replace => ['origin', 'session-connection'], 'transport-protocol' => 'RTP/SAVPF', + 'rtcp-mux' => ['require']}, < 'remove', flags => [qw(port-latching always-transcode SDES-off + no-rtcp-attribute strip-extmap)], + 'transport-protocol' => 'RTP/AVP', replace => ['origin', 'session-connection'], + 'rtcp-mux' => ['demux']}, < 20, 'ptime-reverse' => 20, ICE => 'remove', flags => [qw(no-codec-renegotiation + generate-rtcp port-latching SDES-off codec-strip-telephone-event + codec-strip-G722 codec-strip-PCMU codec-strip-PCMA codec-strip-CN codec-strip-red + codec-mask-opus transcode-PCMU transcode-PCMA transcode-G722 codec-offer-telephone-event + always-transcode no-rtcp-attribute strip-extmap)], + replace => ['origin', 'session-connection'], 'transport-protocol' => 'RTP/AVP', + 'rtcp-mux' => ['demux']}, < 20, 'ptime-reverse' => 20, ICE => 'remove', flags => [qw(no-codec-renegotiation + generate-rtcp port-latching SDES-off codec-strip-telephone-event + codec-strip-G722 codec-strip-PCMU codec-strip-PCMA codec-strip-CN codec-strip-red + codec-mask-opus transcode-PCMU transcode-PCMA transcode-G722 codec-offer-telephone-event + always-transcode no-rtcp-attribute strip-extmap)], + replace => ['origin', 'session-connection'], 'transport-protocol' => 'RTP/AVP', + 'rtcp-mux' => ['demux']}, <