[asterisk-commits] jrose: branch 10 r377261 - in /branches/10: ./ res/res_srtp.c

[SVN commits to the Asterisk project]

Author: jrose
Date: Wed Dec  5 10:57:26 2012
New Revision: 377261

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=377261
Log:
res_srtp: Fix a crash caused by srtp_dealloc on an already dealloced session

When srtp_create fails, the session may be dealloced or just not alloced. At
the same time though, the session pointer might not be set to NULL in this
process and attempting to srtp_dealloc it again will cause a segfault. This
patch checks for failure of srtp_create and sets the session pointer to NULL
if it fails.

(closes issue ASTERISK-20499)
Reported by: tootai
Review: https://reviewboard.asterisk.org/r/2228/
........

Merged revisions 377256 from http://svn.asterisk.org/svn/asterisk/branches/1.8

Modified:
    branches/10/   (props changed)
    branches/10/res/res_srtp.c

Propchange: branches/10/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.

Modified: branches/10/res/res_srtp.c
URL: http://svnview.digium.com/svn/asterisk/branches/10/res/res_srtp.c?view=diff&rev=377261&r1=377260&r2=377261
==============================================================================
--- branches/10/res/res_srtp.c (original)
+++ branches/10/res/res_srtp.c Wed Dec  5 10:57:26 2012
@@ -383,6 +383,8 @@
 					retry++;
 					ao2_iterator_destroy(&it);
 					goto tryagain;
+				} else {
+					srtp->session = NULL;
 				}
 				ao2_t_ref(policy, -1, "Unreffing first policy after srtp_create failed");
 			}
@@ -437,6 +439,8 @@
 
 	/* Any failures after this point can use ast_srtp_destroy to destroy the instance */
 	if (srtp_create(&temp->session, &policy->sp) != err_status_ok) {
+		/* Session either wasn't created or was created and dealloced. */
+		temp->session = NULL;
 		ast_srtp_destroy(temp);
 		return -1;
 	}