kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

FS-10472: [mod_conference] Invalid free in personal canvas mode

This commit is contained in:
Anthony Minessale 2017-07-10 19:13:27 -05:00
parent 69cb420ca9
commit 44021b1c61
3 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/mod/applications/mod_conference/conference_member.c
View File

@ -1161,9 +1161,6 @@ switch_status_t conference_member_del(conference_obj_t *conference, conference_m
} }
member->avatar_patched = 0; member->avatar_patched = 0;
switch_img_free(&member->avatar_png_img);
switch_img_free(&member->video_mute_img);
switch_img_free(&member->pcanvas_img);
switch_mutex_lock(conference->mutex); switch_mutex_lock(conference->mutex);
switch_mutex_lock(conference->member_mutex); switch_mutex_lock(conference->member_mutex);
switch_mutex_lock(member->audio_in_mutex); switch_mutex_lock(member->audio_in_mutex);
@ -1194,6 +1191,10 @@ switch_status_t conference_member_del(conference_obj_t *conference, conference_m
last = imember; last = imember;
} }
switch_img_free(&member->avatar_png_img);
switch_img_free(&member->video_mute_img);
switch_img_free(&member->pcanvas_img);
switch_thread_rwlock_unlock(member->rwlock); switch_thread_rwlock_unlock(member->rwlock);
/* Close Unused Handles */ /* Close Unused Handles */

7
src/mod/applications/mod_conference/conference_video.c
View File

@ -420,8 +420,10 @@ void conference_video_reset_layer(mcu_layer_t *layer)
} }
switch_img_free(&layer->img); switch_img_free(&layer->img);
layer->img = switch_img_alloc(NULL, SWITCH_IMG_FMT_I420, layer->screen_w, layer->screen_h, 1); if (layer->screen_w && layer->screen_h) {
switch_assert(layer->img); layer->img = switch_img_alloc(NULL, SWITCH_IMG_FMT_I420, layer->screen_w, layer->screen_h, 1);
switch_assert(layer->img);
}
conference_video_clear_layer(layer); conference_video_clear_layer(layer);
switch_img_free(&layer->cur_img); switch_img_free(&layer->cur_img);
@ -2570,6 +2572,7 @@ void conference_video_pop_next_image(conference_member_t *member, switch_image_t
if (switch_channel_test_flag(member->channel, CF_VIDEO_READY)) { if (switch_channel_test_flag(member->channel, CF_VIDEO_READY)) {
do { do {
pop = NULL;
if (switch_queue_trypop(member->video_queue, &pop) == SWITCH_STATUS_SUCCESS && pop) { if (switch_queue_trypop(member->video_queue, &pop) == SWITCH_STATUS_SUCCESS && pop) {
switch_img_free(&img); switch_img_free(&img);
img = (switch_image_t *)pop; img = (switch_image_t *)pop;

16
src/switch_core_video.c
View File

@ -190,6 +190,7 @@ SWITCH_DECLARE(switch_image_t *)switch_img_alloc(switch_image_t *img,
unsigned int align) unsigned int align)
{ {
#ifdef SWITCH_HAVE_VPX #ifdef SWITCH_HAVE_VPX
switch_image_t *r = NULL;
#ifdef HAVE_LIBGD #ifdef HAVE_LIBGD
if (fmt == SWITCH_IMG_FMT_GD) { if (fmt == SWITCH_IMG_FMT_GD) {
gdImagePtr gd = gdImageCreateTrueColor(d_w, d_h); gdImagePtr gd = gdImageCreateTrueColor(d_w, d_h);
@ -212,7 +213,14 @@ SWITCH_DECLARE(switch_image_t *)switch_img_alloc(switch_image_t *img,
} }
#endif #endif
return (switch_image_t *)vpx_img_alloc((vpx_image_t *)img, (vpx_img_fmt_t)fmt, d_w, d_h, align); switch_assert(d_w > 0);
switch_assert(d_h > 0);
r = (switch_image_t *)vpx_img_alloc((vpx_image_t *)img, (vpx_img_fmt_t)fmt, d_w, d_h, align);
switch_assert(r);
switch_assert(r->d_w == d_w);
switch_assert(r->d_h = d_h);
return r;
#else #else
return NULL; return NULL;
#endif #endif
@ -291,6 +299,9 @@ SWITCH_DECLARE(void) switch_img_free(switch_image_t **img)
switch_safe_free((*img)->user_priv); switch_safe_free((*img)->user_priv);
} }
} }
switch_assert((*img)->fmt <= SWITCH_IMG_FMT_I44016);
switch_assert((*img)->d_w <= 7860 && (*img)->d_w > 0);
switch_assert((*img)->d_h <= 4320 && (*img)->d_h > 0);
vpx_img_free((vpx_image_t *)*img); vpx_img_free((vpx_image_t *)*img);
*img = NULL; *img = NULL;
} }
@ -3139,6 +3150,9 @@ SWITCH_DECLARE(switch_status_t) switch_img_scale(switch_image_t *src, switch_ima
dest = *destP; dest = *destP;
} }
switch_assert(width > 0);
switch_assert(height > 0);
if (dest && src->fmt != dest->fmt) switch_img_free(&dest); if (dest && src->fmt != dest->fmt) switch_img_free(&dest);
if (!dest) dest = switch_img_alloc(NULL, src->fmt, width, height, 1); if (!dest) dest = switch_img_alloc(NULL, src->fmt, width, height, 1);