Browse Source

TT#14008 fix possible use-after-free

Change-Id: I454d07f339e689bbc349ffef774ded6ef163e985
(cherry picked from commit aae30a4f72)
mr9.5.5
Richard Fuchs 4 years ago
parent
commit
dfb368c4f7
1 changed files with 5 additions and 0 deletions
  1. +5
    -0
      daemon/codec.c

+ 5
- 0
daemon/codec.c View File

@ -1752,6 +1752,9 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
atomic64_inc(&ssrc_in->packets);
atomic64_add(&ssrc_in->octets, mp->payload.len);
// save RTP pointer - we clobber it below XXX this shouldn't be necessary to do
struct rtp_header *orig_rtp = mp->rtp;
packet->p.seq = ntohs(mp->rtp->seq_num);
packet->payload = str_dup(&mp->payload);
uint32_t packet_ts = ntohl(mp->rtp->timestamp);
@ -1840,6 +1843,8 @@ out:
__ssrc_unlock_both(mp);
obj_put(&ch->h);
mp->rtp = orig_rtp;
return 0;
}


Loading…
Cancel
Save