TT#14008 fix possible use-after-free

Change-Id: I454d07f339e689bbc349ffef774ded6ef163e985
(cherry picked from commit aae30a4f72)
(cherry picked from commit 2cd78b33da)
mr10.3.1
Richard Fuchs 4 years ago
parent 5015ea3127
commit 953e87aa12

@ -1555,6 +1555,9 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
return 0;
}
// save RTP pointer - we clobber it below XXX this shouldn't be necessary to do
struct rtp_header *orig_rtp = mp->rtp;
packet->p.seq = ntohs(mp->rtp->seq_num);
packet->payload = str_dup(&mp->payload);
uint32_t packet_ts = ntohl(mp->rtp->timestamp);
@ -1697,6 +1700,8 @@ out_ch:
if (ch)
obj_put(&ch->h);
mp->rtp = orig_rtp;
return 0;
}

Loading…
Cancel
Save