TT#14008 fix possible use-after-free

Change-Id: I454d07f339e689bbc349ffef774ded6ef163e985
(cherry picked from commit aae30a4f72)
(cherry picked from commit 28825d04dc)
mr10.2.1
Richard Fuchs 4 years ago
parent cc71a2d292
commit d409d3f47a

@ -1407,6 +1407,9 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
return 0;
}
// save RTP pointer - we clobber it below XXX this shouldn't be necessary to do
struct rtp_header *orig_rtp = mp->rtp;
packet->p.seq = ntohs(mp->rtp->seq_num);
packet->payload = str_dup(&mp->payload);
uint32_t packet_ts = ntohl(mp->rtp->timestamp);
@ -1523,6 +1526,8 @@ out_ch:
if (ch)
obj_put(&ch->h);
mp->rtp = orig_rtp;
return 0;
}

Loading…
Cancel
Save