kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-03 03:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_speech: Bump reference on format object

Browse Source 
Properly bump reference on format object to avoid memory corruption on double free

ASTERISK-29040 #close

Change-Id: Ic5a7faabfe2ef965ddb024186e1de7ca4542e2a3
This commit is contained in:
Nickolay Shmyrev
2020-08-21 23:53:04 +02:00
committed by George Joseph
parent 75756ab850
commit 444c606161
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
res/res_speech.c
View File

@@ -220,16 +220,17 @@ struct ast_speech *ast_speech_new(const char *engine_name, const struct ast_form
new_speech->engine = engine;
/* Can't forget the format audio is going to be in */
new_speech->format = best;
new_speech->format = ao2_bump(best);
/* We are not ready to accept audio yet */
ast_speech_change_state(new_speech, AST_SPEECH_STATE_NOT_READY);
/* Pass ourselves to the engine so they can set us up some more and if they error out then do not create a structure */
if (engine->create(new_speech, best)) {
if (engine->create(new_speech, new_speech->format)) {
ast_mutex_destroy(&new_speech->lock);
ao2_ref(new_speech->format, -1);
ast_free(new_speech);
new_speech = NULL;
return NULL;
}
return new_speech;