diff options
author | Richard Mudgett <rmudgett@digium.com> | 2017-11-14 18:00:55 -0600 |
---|---|---|
committer | Richard Mudgett <rmudgett@digium.com> | 2017-11-15 16:06:41 -0600 |
commit | 7f916d621a5cceb7173fb5a86d540c73862ce5a2 (patch) | |
tree | 424b1324bc35a3764c6b6368eea6b6633a2cf7bc /main/audiohook.c | |
parent | e25ec49b629e516882faf70dfafb687f39d58cf0 (diff) |
audiohook.c: Fix freeing a frame and still using it.
Memory corruption happened to the media frame caches when an audio hook
freed a frame when it shouldn't. I think the freed frame was because a
jitter buffer interpolated a missing frame and the audio hook
unconditionally freed it.
* Made audiohook.c:audio_audiohook_write_list() not free an interpolated
frame if it is the same frame as what was passed into the routine.
* Made plc.c:normalise_history() use memmove() instead of memcpy() on a
memory block that could overlap. Found by valgrind investigating this
issue.
ASTERISK-27238
ASTERISK-27412
Change-Id: I548d86894281fc4529aefeb9f161f2131ecc6fde
Diffstat (limited to 'main/audiohook.c')
-rw-r--r-- | main/audiohook.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/main/audiohook.c b/main/audiohook.c index 869cb750e..cb3c4bcb3 100644 --- a/main/audiohook.c +++ b/main/audiohook.c @@ -947,7 +947,9 @@ static struct ast_frame *audio_audiohook_write_list(struct ast_channel *chan, st * rely on actual media being present to do things. */ if (!middle_frame->data.ptr) { - ast_frfree(middle_frame); + if (middle_frame != start_frame) { + ast_frfree(middle_frame); + } return start_frame; } |