From 8172b83e23f6017adb4b88da52bb8c7a6f094ad1 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Thu, 28 May 2026 11:58:40 -0400
Subject: [PATCH] MT#55283 protect against invalid metadata

Change-Id: I33e01587a90e517c92fb86519cd0ddf28d32f7ba
---
 recording-daemon/db.c     | 2 ++
 recording-daemon/packet.c | 3 ++-
 recording-daemon/tag.c    | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/recording-daemon/db.c b/recording-daemon/db.c
index 839c9c7bf..bef0515b1 100644
--- a/recording-daemon/db.c
+++ b/recording-daemon/db.c
@@ -383,6 +383,8 @@ void db_do_stream(metafile_t *mf, output_t *op, stream_t *stream, unsigned long
 		return;
 	if (mf->db_id == 0)
 		return;
+	if (!op)
+		return;
 	if (op->db_id > 0)
 		return;
 	if (mf->skip_db)
diff --git a/recording-daemon/packet.c b/recording-daemon/packet.c
index 84b751041..a26164663 100644
--- a/recording-daemon/packet.c
+++ b/recording-daemon/packet.c
@@ -80,7 +80,8 @@ out:
 			char buf[16];
 			snprintf(buf, sizeof(buf), "%08lx", ssrc);
 			tag_t *tag = tag_get(mf, stream->tag);
-			ret->output = output_new_ext(mf, buf, "single", tag->label);
+			if (tag)
+				ret->output = output_new_ext(mf, buf, "single", tag->label);
 		}
 
 		db_do_stream(mf, ret->output, stream, ssrc);
diff --git a/recording-daemon/tag.c b/recording-daemon/tag.c
index de5575591..9b3332699 100644
--- a/recording-daemon/tag.c
+++ b/recording-daemon/tag.c
@@ -3,6 +3,8 @@
 
 // XXX copied from stream.c - unify?
 tag_t *tag_get(metafile_t *mf, unsigned long id) {
+	if (id == -1L)
+		return NULL;
 	if (mf->tags->len <= id)
 		g_ptr_array_set_size(mf->tags, id + 1);
 	tag_t *ret = g_ptr_array_index(mf->tags, id);