[Asterisk-code-review] res_speech: Bump reference on format object (asterisk[13])

[George Joseph]

George Joseph has submitted this change. ( https://gerrit.asterisk.org/c/asterisk/+/14797 )

Change subject: res_speech: Bump reference on format object
......................................................................

res_speech: Bump reference on format object

Properly bump reference on format object to avoid memory corruption on double free

ASTERISK-29040 #close

Change-Id: Ic5a7faabfe2ef965ddb024186e1de7ca4542e2a3
---
M res/res_speech.c
1 file changed, 4 insertions(+), 3 deletions(-)

Approvals:
  Kevin Harwell: Looks good to me, but someone else must approve
  George Joseph: Looks good to me, approved; Approved for Submit
  Friendly Automation: Verified



diff --git a/res/res_speech.c b/res/res_speech.c
index f61588f..d336b8f 100644
--- a/res/res_speech.c
+++ b/res/res_speech.c
@@ -222,16 +222,17 @@
 	new_speech->engine = engine;
 
 	/* Can't forget the format audio is going to be in */
-	new_speech->format = best;
+	new_speech->format = ao2_bump(best);
 
 	/* We are not ready to accept audio yet */
 	ast_speech_change_state(new_speech, AST_SPEECH_STATE_NOT_READY);
 
 	/* Pass ourselves to the engine so they can set us up some more and if they error out then do not create a structure */
-	if (engine->create(new_speech, best)) {
+	if (engine->create(new_speech, new_speech->format)) {
 		ast_mutex_destroy(&new_speech->lock);
+		ao2_ref(new_speech->format, -1);
 		ast_free(new_speech);
-		new_speech = NULL;
+		return NULL;
 	}
 
 	return new_speech;

-- 
To view, visit https://gerrit.asterisk.org/c/asterisk/+/14797
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Change-Id: Ic5a7faabfe2ef965ddb024186e1de7ca4542e2a3
Gerrit-Change-Number: 14797
Gerrit-PatchSet: 2
Gerrit-Owner: Nickolay V. Shmyrev <nshmyrev at alphacephei.com>
Gerrit-Reviewer: Friendly Automation
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Kevin Harwell <kharwell at digium.com>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20200827/9c48cbfe/attachment.html>