From 3f1e34bd7cca7decbe6195bb9be96f7ff3e29d5f Mon Sep 17 00:00:00 2001 From: Torrey Searle Date: Tue, 27 Jun 2017 17:46:43 +0200 Subject: [PATCH] res/res_pjsip_t38: fix incorrect increment of media_count The T38 sdp callback incorrectly has a side effect of incrementing the media_count. This can lead to core dumps. Change-Id: I7bb2f4987de4046ec52cfc34e5ea0662dae32af8 --- res/res_pjsip_t38.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/res/res_pjsip_t38.c b/res/res_pjsip_t38.c index 76434928e7..3028d35f60 100644 --- a/res/res_pjsip_t38.c +++ b/res/res_pjsip_t38.c @@ -278,7 +278,7 @@ static int t38_reinvite_sdp_cb(struct ast_sip_session *session, pjmedia_sdp_sess /* Move the image media stream to the front and have it as the only stream, pjmedia will fill in * dummy streams for the rest */ - for (stream = 0; stream < sdp->media_count++; ++stream) { + for (stream = 0; stream < sdp->media_count; ++stream) { if (!pj_strcmp2(&sdp->media[stream]->desc.media, "image")) { sdp->media[0] = sdp->media[stream]; sdp->media_count = 1; -- 2.47.2