From: Corey Farrell <git@cfware.com>
Date: Fri, 21 Sep 2018 15:19:52 +0000 (-0400)
Subject: res_rtp_asterisk: Fix crash on ast_rtp_new failure.
X-Git-Tag: 16.1.0-rc1~115^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7a7b21f3a0ff4970b8ef85319530ca84a7944b75;p=thirdparty%2Fasterisk.git

res_rtp_asterisk: Fix crash on ast_rtp_new failure.

ast_rtp_new free'd rtp upon failure, but rtp_engine.c would also call
the destroy callback.  Remove call to ast_free from ast_rtp_new, leave
it to rtp_engine.c to initiate the full cleanup.  Add error detection
for the ssrc_mapping vector initialization.  In rtp_allocate_transport
set rtp->s = -1 in the failure path where we close that FD to ensure we
don't try closing it twice.

ASTERISK-27854 #close

Change-Id: Ie02aecbb46228ca804e24b19cec2bb6f7b94e451
---

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index c1aa2757ec..a6be2f5649 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3504,6 +3504,7 @@ static int rtp_allocate_transport(struct ast_rtp_instance *instance, struct ast_
 		if (x == startplace || (errno != EADDRINUSE && errno != EACCES)) {
 			ast_log(LOG_ERROR, "Oh dear... we couldn't allocate a port for RTP instance '%p'\n", instance);
 			close(rtp->s);
+			rtp->s = -1;
 			return -1;
 		}
 	}
@@ -3650,7 +3651,10 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
 	ast_rtp_instance_set_data(instance, rtp);
 
 	if (rtp_allocate_transport(instance, rtp)) {
-		ast_free(rtp);
+		return -1;
+	}
+
+	if (AST_VECTOR_INIT(&rtp->ssrc_mapping, 1)) {
 		return -1;
 	}
 
@@ -3658,7 +3662,6 @@ static int ast_rtp_new(struct ast_rtp_instance *instance,
 	rtp->lastrxformat = ao2_bump(ast_format_none);
 	rtp->lasttxformat = ao2_bump(ast_format_none);
 	rtp->stream_num = -1;
-	AST_VECTOR_INIT(&rtp->ssrc_mapping, 1);
 
 	return 0;
 }