kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

FS-10307: [freeswitch-core] Repetitive verto re-attach with video only channels can cause a buffer overflow #resolve

This commit is contained in:
Anthony Minessale 2017-05-11 13:22:45 -05:00
parent b12bbbc98f
commit db2486919d
1 changed files with 5 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/switch_core_media.c
View File

@ -4403,6 +4403,9 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s
v_engine = &smh->engines[SWITCH_MEDIA_TYPE_VIDEO]; v_engine = &smh->engines[SWITCH_MEDIA_TYPE_VIDEO];
t_engine = &smh->engines[SWITCH_MEDIA_TYPE_TEXT]; t_engine = &smh->engines[SWITCH_MEDIA_TYPE_TEXT];
smh->mparams->num_codecs = 0;
smh->num_negotiated_codecs = 0;
switch_core_media_prepare_codecs(session, SWITCH_TRUE);
codec_array = smh->codecs; codec_array = smh->codecs;
total_codecs = smh->mparams->num_codecs; total_codecs = smh->mparams->num_codecs;
@ -4925,13 +4928,6 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s
} }
smh->mparams->num_codecs = 0;
smh->num_negotiated_codecs = 0;
switch_core_media_prepare_codecs(session, SWITCH_TRUE);
codec_array = smh->codecs;
total_codecs = smh->mparams->num_codecs;
if (switch_rtp_has_dtls() && dtls_ok(session)) { if (switch_rtp_has_dtls() && dtls_ok(session)) {
for (attr = m->m_attributes; attr; attr = attr->a_next) { for (attr = m->m_attributes; attr; attr = attr->a_next) {
@ -5243,7 +5239,7 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s
match = 1; match = 1;
a_engine->codec_negotiated = 1; a_engine->codec_negotiated = 1;
for(j = 0; j < m_idx; j++) { for(j = 0; j < m_idx && smh->num_negotiated_codecs < SWITCH_MAX_CODECS; j++) {
payload_map_t *pmap = switch_core_media_add_payload_map(session, payload_map_t *pmap = switch_core_media_add_payload_map(session,
SWITCH_MEDIA_TYPE_AUDIO, SWITCH_MEDIA_TYPE_AUDIO,
matches[j].map->rm_encoding, matches[j].map->rm_encoding,
@ -5785,7 +5781,7 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s
vmatch = 1; vmatch = 1;
v_engine->codec_negotiated = 1; v_engine->codec_negotiated = 1;
for(j = 0; j < m_idx; j++) { for(j = 0; j < m_idx && smh->num_negotiated_codecs < SWITCH_MAX_CODECS; j++) {
payload_map_t *pmap = switch_core_media_add_payload_map(session, payload_map_t *pmap = switch_core_media_add_payload_map(session,
SWITCH_MEDIA_TYPE_VIDEO, SWITCH_MEDIA_TYPE_VIDEO,
matches[j].map->rm_encoding, matches[j].map->rm_encoding,