kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-04 20:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix a problem where the frame's data pointer is overwritten by the newly

Browse Source 
allocated data buffer before the data can be copied from it.  This is in
the ast_frisolate() function which is rarely used.  (issue #6732, stefankroon)


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@25164 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2006-05-06 02:31:22 +00:00
parent cb263ed3ea
commit 1bea4082a2
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
frame.c
View File

@@ -304,37 +304,41 @@ void ast_frfree(struct ast_frame *fr)
struct ast_frame *ast_frisolate(struct ast_frame *fr) struct ast_frame *ast_frisolate(struct ast_frame *fr)
{ {
struct ast_frame *out; struct ast_frame *out;
void *newdata;
if (!(fr->mallocd & AST_MALLOCD_HDR)) { if (!(fr->mallocd & AST_MALLOCD_HDR)) {
/* Allocate a new header if needed */ /* Allocate a new header if needed */
if (!(out = ast_frame_header_new())) { if (!(out = ast_frame_header_new()))
return NULL; return NULL;
}
out->frametype = fr->frametype; out->frametype = fr->frametype;
out->subclass = fr->subclass; out->subclass = fr->subclass;
out->datalen = fr->datalen; out->datalen = fr->datalen;
out->samples = fr->samples; out->samples = fr->samples;
out->offset = fr->offset; out->offset = fr->offset;
out->src = NULL;
out->data = fr->data; out->data = fr->data;
} else { } else
out = fr; out = fr;
}
if (!(fr->mallocd & AST_MALLOCD_SRC)) { if (!(fr->mallocd & AST_MALLOCD_SRC)) {
if (fr->src) if (fr->src)
out->src = strdup(fr->src); out->src = strdup(fr->src);
} else } else
out->src = fr->src; out->src = fr->src;
if (!(fr->mallocd & AST_MALLOCD_DATA)) { if (!(fr->mallocd & AST_MALLOCD_DATA)) {
if (!(out->data = ast_malloc(fr->datalen + AST_FRIENDLY_OFFSET))) { if (!(newdata = ast_malloc(fr->datalen + AST_FRIENDLY_OFFSET))) {
free(out); free(out);
return NULL; return NULL;
} }
out->data += AST_FRIENDLY_OFFSET; newdata += AST_FRIENDLY_OFFSET;
out->offset = AST_FRIENDLY_OFFSET; out->offset = AST_FRIENDLY_OFFSET;
out->datalen = fr->datalen; out->datalen = fr->datalen;
memcpy(out->data, fr->data, fr->datalen); memcpy(newdata, fr->data, fr->datalen);
out->data = newdata;
} }
out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC | AST_MALLOCD_DATA; out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC | AST_MALLOCD_DATA;
return out; return out;
} }