[Asterisk-code-review] res rtp asterisk: Fix crash on ast rtp new failure. (asterisk[master])

[George Joseph]

George Joseph has submitted this change and it was merged. ( https://gerrit.asterisk.org/10232 )

Change subject: res_rtp_asterisk: Fix crash on ast_rtp_new failure.
......................................................................

res_rtp_asterisk: Fix crash on ast_rtp_new failure.

ast_rtp_new free'd rtp upon failure, but rtp_engine.c would also call
the destroy callback.  Remove call to ast_free from ast_rtp_new, leave
it to rtp_engine.c to initiate the full cleanup.  Add error detection
for the ssrc_mapping vector initialization.  In rtp_allocate_transport
set rtp->s = -1 in the failure path where we close that FD to ensure we
don't try closing it twice.

ASTERISK-27854 #close

Change-Id: Ie02aecbb46228ca804e24b19cec2bb6f7b94e451
---
M res/res_rtp_asterisk.c
1 file changed, 5 insertions(+), 2 deletions(-)

Approvals:
  Kevin Harwell: Looks good to me, but someone else must approve
  Richard Mudgett: Looks good to me, but someone else must approve
  Joshua Colp: Looks good to me, approved
  George Joseph: Approved for Submit



diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index c1aa275..a6be2f5 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3504,6 +3504,7 @@
 		if (x == startplace || (errno != EADDRINUSE && errno != EACCES)) {
 			ast_log(LOG_ERROR, "Oh dear... we couldn't allocate a port for RTP instance '%p'\n", instance);
 			close(rtp->s);
+			rtp->s = -1;
 			return -1;
 		}
 	}
@@ -3650,7 +3651,10 @@
 	ast_rtp_instance_set_data(instance, rtp);
 
 	if (rtp_allocate_transport(instance, rtp)) {
-		ast_free(rtp);
+		return -1;
+	}
+
+	if (AST_VECTOR_INIT(&rtp->ssrc_mapping, 1)) {
 		return -1;
 	}
 
@@ -3658,7 +3662,6 @@
 	rtp->lastrxformat = ao2_bump(ast_format_none);
 	rtp->lasttxformat = ao2_bump(ast_format_none);
 	rtp->stream_num = -1;
-	AST_VECTOR_INIT(&rtp->ssrc_mapping, 1);
 
 	return 0;
 }

-- 
To view, visit https://gerrit.asterisk.org/10232
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Ie02aecbb46228ca804e24b19cec2bb6f7b94e451
Gerrit-Change-Number: 10232
Gerrit-PatchSet: 1
Gerrit-Owner: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Jenkins2 (1000185)
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-Reviewer: Kevin Harwell <kharwell at digium.com>
Gerrit-Reviewer: Richard Mudgett <rmudgett at digium.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20180924/2ea5c1b2/attachment.html>