From: Russell Bryant <russell@russellbryant.com>
Date: Sat, 6 May 2006 02:25:48 +0000 (+0000)
Subject: fix a problem where the frame's data pointer is overwritten by the newly
X-Git-Tag: 1.2.8~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=960ad9e3504c2f4569315ef1d1902377c52ff2cd;p=thirdparty%2Fasterisk.git

fix a problem where the frame's data pointer is overwritten by the newly
allocated data buffer before the data can be copied from it.  This is in
the ast_frisolate() function which is rarely used.  (issue #6732, stefankroon)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@25160 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/frame.c b/frame.c
index fa5538f36d..cef3b8a832 100644
--- a/frame.c
+++ b/frame.c
@@ -304,6 +304,8 @@ void ast_frfree(struct ast_frame *fr)
 struct ast_frame *ast_frisolate(struct ast_frame *fr)
 {
 	struct ast_frame *out;
+	void *newdata;
+
 	if (!(fr->mallocd & AST_MALLOCD_HDR)) {
 		/* Allocate a new header if needed */
 		out = ast_frame_header_new();
@@ -318,27 +320,30 @@ struct ast_frame *ast_frisolate(struct ast_frame *fr)
 		out->offset = fr->offset;
 		out->src = NULL;
 		out->data = fr->data;
-	} else {
+	} else
 		out = fr;
-	}
+	
 	if (!(fr->mallocd & AST_MALLOCD_SRC)) {
 		if (fr->src)
 			out->src = strdup(fr->src);
-	} else
-		out->src = fr->src;
+	}
+	
 	if (!(fr->mallocd & AST_MALLOCD_DATA))  {
-		out->data = malloc(fr->datalen + AST_FRIENDLY_OFFSET);
-		if (!out->data) {
+		newdata = malloc(fr->datalen + AST_FRIENDLY_OFFSET);
+		if (!newdata) {
 			free(out);
 			ast_log(LOG_WARNING, "Out of memory\n");
 			return NULL;
 		}
-		out->data += AST_FRIENDLY_OFFSET;
+		newdata += AST_FRIENDLY_OFFSET;
 		out->offset = AST_FRIENDLY_OFFSET;
 		out->datalen = fr->datalen;
-		memcpy(out->data, fr->data, fr->datalen);
+		memcpy(newdata, fr->data, fr->datalen);
+		out->data = newdata;
 	}
+
 	out->mallocd = AST_MALLOCD_HDR | AST_MALLOCD_SRC | AST_MALLOCD_DATA;
+	
 	return out;
 }