Browse Source

TT#14008 fix possible use-after-free

Change-Id: I454d07f339e689bbc349ffef774ded6ef163e985
(cherry picked from commit aae30a4f72)
(cherry picked from commit 28825d04dc)
mr10.2.1
Richard Fuchs 4 years ago
parent
commit
d409d3f47a
1 changed files with 5 additions and 0 deletions
  1. +5
    -0
      daemon/codec.c

+ 5
- 0
daemon/codec.c View File

@ -1407,6 +1407,9 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
return 0;
}
// save RTP pointer - we clobber it below XXX this shouldn't be necessary to do
struct rtp_header *orig_rtp = mp->rtp;
packet->p.seq = ntohs(mp->rtp->seq_num);
packet->payload = str_dup(&mp->payload);
uint32_t packet_ts = ntohl(mp->rtp->timestamp);
@ -1523,6 +1526,8 @@ out_ch:
if (ch)
obj_put(&ch->h);
mp->rtp = orig_rtp;
return 0;
}


Loading…
Cancel
Save