From 91340fa947d0fa3d9d8eccb3ca7ee5b1b4c4f52f Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Wed, 15 Feb 2023 08:03:33 -0500 Subject: [PATCH] MT#55283 fix possible null deref selected_sfd can be NULL, especially in send-error cases Change-Id: I828dc8556639619fc0cb8f340889ded32dac6de8 --- daemon/media_socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/daemon/media_socket.c b/daemon/media_socket.c index db3105e61..aa0c82cc2 100644 --- a/daemon/media_socket.c +++ b/daemon/media_socket.c @@ -1640,6 +1640,8 @@ void media_update_stats(struct call_media *m) { continue; if (PS_ISSET(ps, NO_KERNEL_SUPPORT)) continue; + if (!ps->selected_sfd) + continue; __stream_update_stats(ps, false); } @@ -2669,7 +2671,8 @@ next_mirror: err_next: ilog(LOG_DEBUG | LOG_FLAG_LIMIT ,"Error when sending message. Error: %s", strerror(errno)); atomic64_inc(&sink->stats_in.errors); - atomic64_inc(&sink->selected_sfd->local_intf->stats.out.errors); + if (sink->selected_sfd) + atomic64_inc(&sink->selected_sfd->local_intf->stats.out.errors); RTPE_STATS_INC(errors_user); goto next;