diff options
author | mmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-27 20:06:01 +0000 |
---|---|---|
committer | mmichelson <mmichelson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-27 20:06:01 +0000 |
commit | c9b68664c957fa8e4d90666ef2f09800d656e491 (patch) | |
tree | 40ef9fb43a99f631746f422155c29106d0bc6806 /main/slinfactory.c | |
parent | 9efad196fbc781c8f2ed2216bb1f60a8b9cb1cc0 (diff) |
Prevent a crash from occurring when a jitter buffer interpolated frame is
removed from a slinfactory
slinfactory used the "samples" field of an ast_frame in order to determine
the amount of data contained within the frame. In certain cases, such as
jitter buffer interpolated frames, the frame would have a non-zero value for
"samples" but have NULL "data"
This caused a problem when a memcpy call in ast_slinfactory_read would attempt
to access invalid memory. The solution in use here is to never feed frames into
the slinfactory if they have NULL "data"
(closes issue #13116)
Reported by: aragon
Patches:
13116.diff uploaded by putnopvut (license 60)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@171621 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main/slinfactory.c')
-rw-r--r-- | main/slinfactory.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/main/slinfactory.c b/main/slinfactory.c index bd5b8de4f..212edef92 100644 --- a/main/slinfactory.c +++ b/main/slinfactory.c @@ -59,6 +59,16 @@ int ast_slinfactory_feed(struct ast_slinfactory *sf, struct ast_frame *f) struct ast_frame *begin_frame = f, *duped_frame = NULL, *frame_ptr; unsigned int x; + /* In some cases, we can be passed a frame which has no data in it, but + * which has a positive number of samples defined. Once such situation is + * when a jitter buffer is in use and the jitter buffer interpolates a frame. + * The frame it produces has data set to NULL, datalen set to 0, and samples + * set to either 160 or 240. + */ + if (!f->data) { + return 0; + } + if (f->subclass != AST_FORMAT_SLINEAR) { if (sf->trans && f->subclass != sf->format) { ast_translator_free_path(sf->trans); |