kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-05 20:20:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_rtp_asterisk: Resolve 2 discrete memory leaks in DTLS

Browse Source 
ao2 ref leak in res_rtp_asterisk.c when a DTLS policy is created.
The resources are linked into a table, but the original alloc refs
are never released. ast_strdup leak in rtp_engine.c. If
ast_rtp_dtls_cfg_copy() is called twice on the same destination struct,
a pointer to an alloc'd string is overwritten before the string is free'd.

ASTERISK-25022
Reported by: one47

Change-Id: I62a8ceb8679709f6c3769136dc6aa9a68202ff9b
This commit is contained in:
Steve Davies
2015-04-28 11:38:30 +01:00
committed by Joshua Colp
parent b2153f1f49
commit 5e96584829
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
main/rtp_engine.c
View File

@@ -1659,6 +1659,8 @@ int ast_rtp_dtls_cfg_parse(struct ast_rtp_dtls_cfg *dtls_cfg, const char *name,
void ast_rtp_dtls_cfg_copy(const struct ast_rtp_dtls_cfg *src_cfg, struct ast_rtp_dtls_cfg *dst_cfg) void ast_rtp_dtls_cfg_copy(const struct ast_rtp_dtls_cfg *src_cfg, struct ast_rtp_dtls_cfg *dst_cfg)
{ {
ast_rtp_dtls_cfg_free(dst_cfg); /* Prevent a double-call leaking memory via ast_strdup */
dst_cfg->enabled = src_cfg->enabled; dst_cfg->enabled = src_cfg->enabled;
dst_cfg->verify = src_cfg->verify; dst_cfg->verify = src_cfg->verify;
dst_cfg->rekey = src_cfg->rekey; dst_cfg->rekey = src_cfg->rekey;

6
res/res_rtp_asterisk.c
View File

@@ -1869,6 +1869,7 @@ static int dtls_srtp_setup(struct ast_rtp *rtp, struct ast_srtp *srtp, struct as
unsigned char *local_key, *local_salt, *remote_key, *remote_salt; unsigned char *local_key, *local_salt, *remote_key, *remote_salt;
struct ast_srtp_policy *local_policy, *remote_policy = NULL; struct ast_srtp_policy *local_policy, *remote_policy = NULL;
struct ast_rtp_instance_stats stats = { 0, }; struct ast_rtp_instance_stats stats = { 0, };
int res = -1;
/* If a fingerprint is present in the SDP make sure that the peer certificate matches it */ /* If a fingerprint is present in the SDP make sure that the peer certificate matches it */
if (rtp->dtls_verify & AST_RTP_DTLS_VERIFY_FINGERPRINT) { if (rtp->dtls_verify & AST_RTP_DTLS_VERIFY_FINGERPRINT) {
@@ -1983,16 +1984,17 @@ static int dtls_srtp_setup(struct ast_rtp *rtp, struct ast_srtp *srtp, struct as
} }
} }
return 0; res = 0;
error: error:
/* policy->destroy() called even on success to release local reference to these resources */
res_srtp_policy->destroy(local_policy); res_srtp_policy->destroy(local_policy);
if (remote_policy) { if (remote_policy) {
res_srtp_policy->destroy(remote_policy); res_srtp_policy->destroy(remote_policy);
} }
return -1; return res;
} }
#endif #endif