diff options
| author | Hadriel Kaplan <hadrielk@yahoo.com> | 2014-04-02 02:07:16 -0400 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2014-04-03 04:40:20 +0000 |
| commit | 04c05a21e34cec326f1aff2f5f8a6e74e1ced984 (patch) | |
| tree | 6db27e328578c12b6c1c4841a708e12eec0f4c24 /asn1/h245 | |
| parent | df80f3133cc3b128ea989ad6830511c378fa0b63 (diff) | |
Fix Bug 9920 Buildbot crash due to SDP/RTP mismatch
For details see comments in Bug 9920.
The executive summary:
Bug 9920 is a crash caused by a couple of issues:
1) The memory ownership model for the rtp_dyn_payload hashtable is split: SDP
creates the rtp_dyn_payload hashtable, but RTP can free it. Since there isn't
*one* pointer to the hashtable, RTP freeing it means SDP has a dangling
pointer.
2) Either the SDP dissector shouldn't be creating two separate, unique
hashtables for multiple media channels of the same addr:port, or RTP shouldn't
be free'ing the previous one.
Change-Id: I436e67de6882f84aa82dcbdfe60bf313fe4fd99c
Reviewed-on: https://code.wireshark.org/review/918
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'asn1/h245')
| -rw-r--r-- | asn1/h245/packet-h245-template.c | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/asn1/h245/packet-h245-template.c b/asn1/h245/packet-h245-template.c index 73b547446a..60fe8f1860 100644 --- a/asn1/h245/packet-h245-template.c +++ b/asn1/h245/packet-h245-template.c @@ -341,8 +341,7 @@ static void update_unicast_addr(unicast_addr_t *req_addr, unicast_addr_t *ack_ad static void h245_setup_channels(packet_info *pinfo, channel_info_t *upcoming_channel_lcl) { - gint *key; - GHashTable *rtp_dyn_payload = NULL; + rtp_dyn_payload_t *rtp_dyn_payload = NULL; struct srtp_info *dummy_srtp_info = NULL; if (!upcoming_channel_lcl) return; @@ -359,13 +358,8 @@ static void h245_setup_channels(packet_info *pinfo, channel_info_t *upcoming_cha /* (S)RTP, (S)RTCP */ if (upcoming_channel_lcl->rfc2198 > 0) { - encoding_name_and_rate_t *encoding_name_and_rate = wmem_new(wmem_file_scope(), encoding_name_and_rate_t); - rtp_dyn_payload = g_hash_table_new(g_int_hash, g_int_equal); - encoding_name_and_rate->encoding_name = wmem_strdup(wmem_file_scope(), "red"); - encoding_name_and_rate->sample_rate = 8000; - key = wmem_new(wmem_file_scope(), gint); - *key = upcoming_channel_lcl->rfc2198; - g_hash_table_insert(rtp_dyn_payload, key, encoding_name_and_rate); + rtp_dyn_payload = rtp_dyn_payload_new(); + rtp_dyn_payload_insert(rtp_dyn_payload, upcoming_channel_lcl->rfc2198, "red", 8000); } if (upcoming_channel_lcl->srtp_flag) { |