From d6e5dc64a31e37d45fce6d98b83e2a258ecb3121 Mon Sep 17 00:00:00 2001 From: Bradley Jokinen Date: Mon, 17 Aug 2015 08:52:58 -0500 Subject: [PATCH] FS-7970 Fixed crash in video_bug_thread caused by double free --- src/switch_core_media_bug.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/src/switch_core_media_bug.c b/src/switch_core_media_bug.c index 28f461c3f1..681bd4d173 100644 --- a/src/switch_core_media_bug.c +++ b/src/switch_core_media_bug.c @@ -565,6 +565,9 @@ static void *SWITCH_THREAD_FUNC video_bug_thread(switch_thread_t *thread, void * img = (switch_image_t *) pop; + w = img->d_w; + h = img->d_h; + if (other_q) { while(switch_queue_size(other_q) > 0) { if ((status = switch_queue_trypop(other_q, &pop)) == SWITCH_STATUS_SUCCESS) { @@ -574,12 +577,7 @@ static void *SWITCH_THREAD_FUNC video_bug_thread(switch_thread_t *thread, void * } } } - } - w = img->d_w; - h = img->d_h; - - if (other_q) { if (other_img) { if (other_img->d_w != w || other_img->d_h != h) { switch_image_t *tmp_img = NULL; @@ -602,14 +600,11 @@ static void *SWITCH_THREAD_FUNC video_bug_thread(switch_thread_t *thread, void * if (other_img) { switch_img_patch(IMG, other_img, w / 2, 0); } - - } else { - IMG = img; } switch_thread_rwlock_rdlock(bug->session->bug_rwlock); //switch_mutex_lock(bug->read_mutex); - frame.img = IMG; + frame.img = other_q ? IMG : img; bug->ping_frame = &frame; if (bug->callback) { if (bug->callback(bug, bug->user_data, SWITCH_ABC_TYPE_STREAM_VIDEO_PING) == SWITCH_FALSE