res_rtp_asterisk: Fix crash on ast_rtp_new failure.

ast_rtp_new free'd rtp upon failure, but rtp_engine.c would also call
the destroy callback.  Remove call to ast_free from ast_rtp_new, leave
it to rtp_engine.c to initiate the full cleanup.  Add error detection
for the ssrc_mapping vector initialization.  In rtp_allocate_transport
set rtp->s = -1 in the failure path where we close that FD to ensure we
don't try closing it twice.

ASTERISK-27854 #close

Change-Id: Ie02aecbb46228ca804e24b19cec2bb6f7b94e451

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index c1aa2757ecd0769c54dc36be85494a7c58066b97..a6be2f5649cd7ebb0120b831935dd699eab96bf9 100644 (file)
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3504,6 +3504,7 @@ static int rtp_allocate_transport(struct ast_rtp_instance *instance, struct ast_
                if (x == startplace || (errno != EADDRINUSE && errno != EACCES)) {
                        ast_log(LOG_ERROR, "Oh dear... we couldn't allocate a port for RTP instance '%p'\n", instance);
                        close(rtp->s);
+                       rtp->s = -1;
                        return -1;
                }
        }
@@ -3650,7 +3651,10 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
        ast_rtp_instance_set_data(instance, rtp);
 
        if (rtp_allocate_transport(instance, rtp)) {
-               ast_free(rtp);
+               return -1;
+       }
+
+       if (AST_VECTOR_INIT(&rtp->ssrc_mapping, 1)) {
                return -1;
        }
 
@@ -3658,7 +3662,6 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
        rtp->lastrxformat = ao2_bump(ast_format_none);
        rtp->lasttxformat = ao2_bump(ast_format_none);
        rtp->stream_num = -1;
-       AST_VECTOR_INIT(&rtp->ssrc_mapping, 1);
 
        return 0;
 }