Browse code

b/f: hot fix for possible infinite loop in PacketMem::newPacket()

If PacketMem::freePacket() is called twice for the same packet, the RTP receiver would block for ever in PacketMem::newPacket().

Many thanks to our anonymous friend at onat.edu.ua!

Raphael Coeffic authored on 28/02/2013 11:55:46
Showing 1 changed files
... ...
@@ -1021,6 +1021,15 @@ inline AmRtpPacket* PacketMem::newPacket() {
1021 1021
 inline void PacketMem::freePacket(AmRtpPacket* p) {
1022 1022
   if (!p)  return;
1023 1023
 
1024
+  int idx = p-packets;
1025
+  assert(idx > 0);
1026
+  assert(idx < MAX_PACKETS);
1027
+
1028
+  if(!used[idx]) {
1029
+    ERROR("freePacket() double free: n_used = %d, idx = %d",n_used,idx);
1030
+    return;
1031
+  }
1032
+
1024 1033
   used[p-packets] = false;
1025 1034
 }
1026 1035