generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Heap-use-after-free in WebRtcNetEQ_RecInRTPStruct

Browse Source 
Pointer to released memory was not set to NULL, which means
you could get a heap-us-after-free in the code. It happens if one of the slaves of NetEq is deleted, but we keep trying to decode packets.

BUG=
R=henrik.lundin@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/2259004

git-svn-id: http://webrtc.googlecode.com/svn/trunk@4792 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
tina.legrand@webrtc.org
2013-09-19 13:32:14 +00:00
parent ab6549562b
commit a03e34e9ab
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
webrtc/modules/audio_coding/main/source/acm_neteq.cc
View File

@@ -131,6 +131,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]);
inst_mem_[idx] = NULL;
inst_[idx] = NULL;
}
inst_mem_[idx] = malloc(memory_size_bytes);
if (inst_mem_[idx] == NULL) {
@@ -144,6 +145,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]);
inst_mem_[idx] = NULL;
inst_[idx] = NULL;
}
LogError("Assign", idx);
WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_,
@@ -155,6 +157,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]);
inst_mem_[idx] = NULL;
inst_[idx] = NULL;
}
LogError("Init", idx);
WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_,
@@ -971,6 +974,7 @@ void ACMNetEQ::RemoveNetEQSafe(int index) {
if (inst_mem_[index] != NULL) {
free(inst_mem_[index]);
inst_mem_[index] = NULL;
inst_[index] = NULL;
}
if (neteq_packet_buffer_[index] != NULL) {
free(neteq_packet_buffer_[index]);