From b576b58d74e2ec85bdd4ea62912261896beee976 Mon Sep 17 00:00:00 2001
From: Richard Mudgett <rmudgett@digium.com>
Date: Wed, 21 Dec 2016 16:28:00 -0600
Subject: [PATCH] res_rtp_asterisk.c: Fix uninitialized memory crash.
ast_rtp_remote_address_set() could pass an uninitialized 'us' parameter to
ast_ouraddrfor(). If ast_ouraddrfor() returns an error then the 'us'
parameter may not get initialized. Thus when the code tries to save the
'us' parameter to the local address we could try to copy a ridiculous
sized memory buffer and segfault.
* Made pass an initialized 'us' parameter to ast_ouraddrfor().
* Optimized out the 'us' struct variable.
ASTERISK-26672 #close
Change-Id: I4acea5dcdf0813da2c7d3e11c2d6067d160d17dc
---
res/res_rtp_asterisk.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 1721811eed..4c79f8f5b5 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -5005,31 +5005,31 @@ static int ast_rtp_fd(struct ast_rtp_instance *instance, int rtcp)
static void ast_rtp_remote_address_set(struct ast_rtp_instance *instance, struct ast_sockaddr *addr)
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
- struct ast_sockaddr local, us;
+ struct ast_sockaddr local;
+ ast_rtp_instance_get_local_address(instance, &local);
if (!ast_sockaddr_isnull(addr)) {
/* Update the local RTP address with what is being used */
- ast_ouraddrfor(addr, &us);
- ast_rtp_instance_get_local_address(instance, &local);
- ast_sockaddr_set_port(&us, ast_sockaddr_port(&local));
- ast_rtp_instance_set_local_address(instance, &us);
+ if (ast_ouraddrfor(addr, &local)) {
+ /* Failed to update our address so reuse old local address */
+ ast_rtp_instance_get_local_address(instance, &local);
+ } else {
+ ast_rtp_instance_set_local_address(instance, &local);
+ }
}
if (rtp->rtcp) {
ast_debug(1, "Setting RTCP address on RTP instance '%p'\n", instance);
ast_sockaddr_copy(&rtp->rtcp->them, addr);
if (!ast_sockaddr_isnull(addr)) {
- ast_sockaddr_set_port(&rtp->rtcp->them,
- ast_sockaddr_port(addr) + 1);
- }
+ ast_sockaddr_set_port(&rtp->rtcp->them, ast_sockaddr_port(addr) + 1);
- if (!ast_sockaddr_isnull(addr)) {
/* Update the local RTCP address with what is being used */
- ast_sockaddr_set_port(&us, ast_sockaddr_port(&local) + 1);
- ast_sockaddr_copy(&rtp->rtcp->us, &us);
+ ast_sockaddr_set_port(&local, ast_sockaddr_port(&local) + 1);
+ ast_sockaddr_copy(&rtp->rtcp->us, &local);
ast_free(rtp->rtcp->local_addr_str);
- rtp->rtcp->local_addr_str = ast_strdup(ast_sockaddr_stringify(&us));
+ rtp->rtcp->local_addr_str = ast_strdup(ast_sockaddr_stringify(&local));
}
}
@@ -5039,8 +5039,6 @@ static void ast_rtp_remote_address_set(struct ast_rtp_instance *instance, struct
rtp->strict_rtp_state = STRICT_RTP_LEARN;
rtp_learning_seq_init(&rtp->rtp_source_learn, rtp->seqno);
}
-
- return;
}
/*! \brief Write t140 redundacy frame
--
GitLab