From fbf74bfe2d584323ecaf8aadd13b1cfdd8b59e02 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Wed, 27 Jan 2021 10:18:14 -0500
Subject: [PATCH] TT#14008 fix possible segfault

closes #1172

Change-Id: I94bb52c290c2032073e54528283660f03e694033
---
 daemon/jitter_buffer.c | 8 +++-----
 daemon/media_socket.c  | 9 ++++++---
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/daemon/jitter_buffer.c b/daemon/jitter_buffer.c
index ac25a4f16..26593ecb6 100644
--- a/daemon/jitter_buffer.c
+++ b/daemon/jitter_buffer.c
@@ -99,6 +99,9 @@ static int get_clock_rate(struct media_packet *mp, int payload_type) {
 }
 
 static struct jb_packet* get_jb_packet(struct media_packet *mp, const str *s) {
+	if (rtp_payload(&mp->rtp, &mp->payload, &mp->raw))
+		return NULL;
+
 	char *buf = malloc(s->len + RTP_BUFFER_HEAD_ROOM + RTP_BUFFER_TAIL_ROOM);
 	if (!buf) {
 		ilog(LOG_ERROR, "Failed to allocate memory: %s", strerror(errno));
@@ -113,11 +116,6 @@ static struct jb_packet* get_jb_packet(struct media_packet *mp, const str *s) {
 	str_init_len(&p->mp.raw, buf + RTP_BUFFER_HEAD_ROOM, s->len);
 	memcpy(p->mp.raw.s, s->s, s->len);
 
-	if(rtp_payload(&p->mp.rtp, &p->mp.payload, &p->mp.raw)) {
-		jb_packet_free(&p);
-		return NULL;
-	}
-
 	return p;
 }
 
diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index 9ea26974a..8c32a0215 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -1939,9 +1939,12 @@ void media_packet_copy(struct media_packet *dst, const struct media_packet *src)
 	dst->raw = STR_NULL;
 }
 void media_packet_release(struct media_packet *mp) {
-	obj_put(mp->sfd);
-	obj_put(&mp->ssrc_in->parent->h);
-	obj_put(&mp->ssrc_out->parent->h);
+	if (mp->sfd)
+		obj_put(mp->sfd);
+	if (mp->ssrc_in)
+		obj_put(&mp->ssrc_in->parent->h);
+	if (mp->ssrc_out)
+		obj_put(&mp->ssrc_out->parent->h);
 	g_queue_clear_full(&mp->packets_out, codec_packet_free);
 	g_free(mp->rtp);
 	g_free(mp->rtcp);