kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-31 18:55:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix a problem where the frame's data pointer is overwritten by the newly

Browse Source 
allocated data buffer before the data can be copied from it.  This is in
the ast_frisolate() function which is rarely used.  (issue #6732, stefankroon)


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@25164 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2006-05-06 02:31:22 +00:00
parent cb263ed3ea
commit 1bea4082a2
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
frame.c
View File

@@ -304,37 +304,41 @@ void ast_frfree(struct ast_frame *fr)
struct ast_frame *ast_frisolate(struct ast_frame *fr)
{
struct ast_frame *out;
void *newdata;
if (!(fr->mallocd & AST_MALLOCD_HDR)) {
/* Allocate a new header if needed */
if (!(out = ast_frame_header_new())) {
if (!(out = ast_frame_header_new()))
return NULL;
}
out->frametype = fr->frametype;
out->subclass = fr->subclass;
out->datalen = fr->datalen;
out->samples = fr->samples;
out->offset = fr->offset;
out->src = NULL;
out->data = fr->data;
} else {
} else
out = fr;
}
if (!(fr->mallocd & AST_MALLOCD_SRC)) {
if (fr->src)
out->src = strdup(fr->src);
} else
out->src = fr->src;
if (!(fr->mallocd & AST_MALLOCD_DATA)) {
if (!(out->data = ast_malloc(fr->datalen + AST_FRIENDLY_OFFSET))) {
if (!(newdata = ast_malloc(fr->datalen + AST_FRIENDLY_OFFSET))) {
free(out);
return NULL;
}
out->data += AST_FRIENDLY_OFFSET;
newdata += AST_FRIENDLY_OFFSET;
out->offset = AST_FRIENDLY_OFFSET;
out->datalen = fr->datalen;
memcpy(out->data, fr->data, fr->datalen);
memcpy(newdata, fr->data, fr->datalen);
out->data = newdata;
}
out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC | AST_MALLOCD_DATA;
return out;
}