[asterisk-commits] mmichelson: branch 1.4 r171621 - /branches/1.4/main/slinfactory.c

[SVN commits to the Asterisk project]

Author: mmichelson
Date: Tue Jan 27 14:06:01 2009
New Revision: 171621

URL: http://svn.digium.com/svn-view/asterisk?view=rev&rev=171621
Log:
Prevent a crash from occurring when a jitter buffer interpolated frame is
removed from a slinfactory

slinfactory used the "samples" field of an ast_frame in order to determine
the amount of data contained within the frame. In certain cases, such as
jitter buffer interpolated frames, the frame would have a non-zero value for
"samples" but have NULL "data"

This caused a problem when a memcpy call in ast_slinfactory_read would attempt
to access invalid memory. The solution in use here is to never feed frames into
the slinfactory if they have NULL "data"

(closes issue #13116)
Reported by: aragon
Patches:
      13116.diff uploaded by putnopvut (license 60)


Modified:
    branches/1.4/main/slinfactory.c

Modified: branches/1.4/main/slinfactory.c
URL: http://svn.digium.com/svn-view/asterisk/branches/1.4/main/slinfactory.c?view=diff&rev=171621&r1=171620&r2=171621
==============================================================================
--- branches/1.4/main/slinfactory.c (original)
+++ branches/1.4/main/slinfactory.c Tue Jan 27 14:06:01 2009
@@ -58,6 +58,16 @@
 {
 	struct ast_frame *begin_frame = f, *duped_frame = NULL, *frame_ptr;
 	unsigned int x;
+
+	/* In some cases, we can be passed a frame which has no data in it, but
+	 * which has a positive number of samples defined. Once such situation is
+	 * when a jitter buffer is in use and the jitter buffer interpolates a frame.
+	 * The frame it produces has data set to NULL, datalen set to 0, and samples
+	 * set to either 160 or 240.
+	 */
+	if (!f->data) {
+		return 0;
+	}
 
 	if (f->subclass != AST_FORMAT_SLINEAR) {
 		if (sf->trans && f->subclass != sf->format) {