diff options
author | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-05-06 02:25:48 +0000 |
---|---|---|
committer | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-05-06 02:25:48 +0000 |
commit | 72f040281b09f8ad7c44558ea46e28fa6dee0565 (patch) | |
tree | 673406e0844f13c3d8c631b77505c9f8587f91e0 | |
parent | a09120f59c356875913b78b1cc187134ec308920 (diff) |
fix a problem where the frame's data pointer is overwritten by the newly
allocated data buffer before the data can be copied from it. This is in
the ast_frisolate() function which is rarely used. (issue #6732, stefankroon)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.2@25160 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r-- | frame.c | 21 |
1 files changed, 13 insertions, 8 deletions
@@ -304,6 +304,8 @@ void ast_frfree(struct ast_frame *fr) struct ast_frame *ast_frisolate(struct ast_frame *fr) { struct ast_frame *out; + void *newdata; + if (!(fr->mallocd & AST_MALLOCD_HDR)) { /* Allocate a new header if needed */ out = ast_frame_header_new(); @@ -318,27 +320,30 @@ struct ast_frame *ast_frisolate(struct ast_frame *fr) out->offset = fr->offset; out->src = NULL; out->data = fr->data; - } else { + } else out = fr; - } + if (!(fr->mallocd & AST_MALLOCD_SRC)) { if (fr->src) out->src = strdup(fr->src); - } else - out->src = fr->src; + } + if (!(fr->mallocd & AST_MALLOCD_DATA)) { - out->data = malloc(fr->datalen + AST_FRIENDLY_OFFSET); - if (!out->data) { + newdata = malloc(fr->datalen + AST_FRIENDLY_OFFSET); + if (!newdata) { free(out); ast_log(LOG_WARNING, "Out of memory\n"); return NULL; } - out->data += AST_FRIENDLY_OFFSET; + newdata += AST_FRIENDLY_OFFSET; out->offset = AST_FRIENDLY_OFFSET; out->datalen = fr->datalen; - memcpy(out->data, fr->data, fr->datalen); + memcpy(newdata, fr->data, fr->datalen); + out->data = newdata; } + out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC | AST_MALLOCD_DATA; + return out; } |