rtp_engine.c: Prevent segfault in ast_rtp_codecs_payloads_unset()

There can be empty slots in payload_mapping_tx corresponding to
dynamic payload types that haven't been seen before so we now
check for NULL before attempting to use 'type' in the call to
ast_format_cmp.

Note: Currently only chan_sip calls ast_rtp_codecs_payloads_unset()

Resolves: #822

diff --git a/main/rtp_engine.c b/main/rtp_engine.c
index 663b4954c578981e1d540166b0a4264cf3474e7c..62f79ae5e9b0c5ea2192c1e8981ebe90548df4c1 100644 (file)
--- a/main/rtp_engine.c
+++ b/main/rtp_engine.c
@@ -1485,12 +1485,21 @@ void ast_rtp_codecs_payloads_unset(struct ast_rtp_codecs *codecs, struct ast_rtp
 
        if (payload < AST_VECTOR_SIZE(&codecs->payload_mapping_tx)) {
                type = AST_VECTOR_GET(&codecs->payload_mapping_tx, payload);
-               /* remove the preferred format if we are unsetting its container. */
-               if (ast_format_cmp(type->format, codecs->preferred_format) == AST_FORMAT_CMP_EQUAL) {
-                       ao2_replace(codecs->preferred_format, NULL);
+               /*
+                * Remove the preferred format if we are unsetting its container.
+                *
+                * There can be empty slots in payload_mapping_tx corresponding to
+                * dynamic payload types that haven't been seen before so we need
+                * to check for NULL before attempting to use 'type' in the call to
+                * ast_format_cmp.
+                */
+               if (type) {
+                       if (ast_format_cmp(type->format, codecs->preferred_format) == AST_FORMAT_CMP_EQUAL) {
+                               ao2_replace(codecs->preferred_format, NULL);
+                       }
+                       ao2_ref(type, -1);
+                       AST_VECTOR_REPLACE(&codecs->payload_mapping_tx, payload, NULL);
                }
-               ao2_cleanup(type);
-               AST_VECTOR_REPLACE(&codecs->payload_mapping_tx, payload, NULL);
        }
 
        if (instance && instance->engine && instance->engine->payload_set) {