From: Pirmin Walthert <infos@nappsoft.ch>
Date: Tue, 14 Apr 2020 15:48:07 +0000 (+0200)
Subject: res_rtp_asterisk: Resolve loop when receive buffer is flushed
X-Git-Tag: certified/16.8-cert1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22bc8a71680e4099ffd3ccff7b3fe33d26291c36;p=thirdparty%2Fasterisk.git

res_rtp_asterisk: Resolve loop when receive buffer is flushed

When the receive buffer was flushed by a received packet while it
already contained a packet with the same sequence number, Asterisk
never left the while loop which tried to order the packets.

This change makes it so if the packet is in the receive buffer it
is retrieved and freed allowing the buffer to empty.

ASTERISK-28827

Change-Id: Idaa376101bc1ac880047c49feb6faee773e718b3
---

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 6c4f408025..134eebc07c 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -7736,6 +7736,14 @@ static struct ast_frame *ast_rtp_read(struct ast_rtp_instance *instance, int rtc
 					ast_debug(2, "Inserted just received packet with sequence number '%d' in correct order on RTP instance '%p'\n",
 						seqno, instance);
 				}
+				/* It is possible due to packet retransmission for this packet to also exist in the receive
+				 * buffer so we explicitly remove it in case this occurs, otherwise the receive buffer will
+				 * never be empty.
+				 */
+				payload = (struct ast_rtp_rtcp_nack_payload *)ast_data_buffer_remove(rtp->recv_buffer, seqno);
+				if (payload) {
+					ast_free(payload);
+				}
 				rtp->expectedrxseqno++;
 				if (rtp->expectedrxseqno == SEQNO_CYCLE_OVER) {
 					rtp->expectedrxseqno = 0;