Heap-use-after-free in WebRtcNetEQ_RecInRTPStruct

Pointer to released memory was not set to NULL, which means
you could get a heap-us-after-free in the code. It happens if one of the slaves of NetEq is deleted, but we keep trying to decode packets.

BUG=
R=henrik.lundin@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/2259004

git-svn-id: http://webrtc.googlecode.com/svn/trunk@4792 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
tina.legrand@webrtc.org 2013-09-19 13:32:14 +00:00
parent ab6549562b
commit a03e34e9ab

View File

@ -131,6 +131,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) { if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]); free(inst_mem_[idx]);
inst_mem_[idx] = NULL; inst_mem_[idx] = NULL;
inst_[idx] = NULL;
} }
inst_mem_[idx] = malloc(memory_size_bytes); inst_mem_[idx] = malloc(memory_size_bytes);
if (inst_mem_[idx] == NULL) { if (inst_mem_[idx] == NULL) {
@ -144,6 +145,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) { if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]); free(inst_mem_[idx]);
inst_mem_[idx] = NULL; inst_mem_[idx] = NULL;
inst_[idx] = NULL;
} }
LogError("Assign", idx); LogError("Assign", idx);
WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_, WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_,
@ -155,6 +157,7 @@ int16_t ACMNetEQ::InitByIdxSafe(const int16_t idx) {
if (inst_mem_[idx] != NULL) { if (inst_mem_[idx] != NULL) {
free(inst_mem_[idx]); free(inst_mem_[idx]);
inst_mem_[idx] = NULL; inst_mem_[idx] = NULL;
inst_[idx] = NULL;
} }
LogError("Init", idx); LogError("Init", idx);
WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_, WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceAudioCoding, id_,
@ -971,6 +974,7 @@ void ACMNetEQ::RemoveNetEQSafe(int index) {
if (inst_mem_[index] != NULL) { if (inst_mem_[index] != NULL) {
free(inst_mem_[index]); free(inst_mem_[index]);
inst_mem_[index] = NULL; inst_mem_[index] = NULL;
inst_[index] = NULL;
} }
if (neteq_packet_buffer_[index] != NULL) { if (neteq_packet_buffer_[index] != NULL) {
free(neteq_packet_buffer_[index]); free(neteq_packet_buffer_[index]);