sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

res_speech: Bump reference on format object 

Properly bump reference on format object to avoid memory corruption on double free

ASTERISK-29040 #close

Change-Id: Ic5a7faabfe2ef965ddb024186e1de7ca4542e2a3
This commit is contained in:
Nickolay Shmyrev 2020-08-21 23:53:04 +02:00 committed by George Joseph
parent 04051b324b
commit 5b9ac90531
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
res/res_speech.c
View File

@ -220,16 +220,17 @@ struct ast_speech *ast_speech_new(const char *engine_name, const struct ast_form
new_speech->engine = engine;
/* Can't forget the format audio is going to be in */
new_speech->format = best;
new_speech->format = ao2_bump(best);
/* We are not ready to accept audio yet */
ast_speech_change_state(new_speech, AST_SPEECH_STATE_NOT_READY);
/* Pass ourselves to the engine so they can set us up some more and if they error out then do not create a structure */
if (engine->create(new_speech, best)) {
if (engine->create(new_speech, new_speech->format)) {
ast_mutex_destroy(&new_speech->lock);
ao2_ref(new_speech->format, -1);
ast_free(new_speech);
new_speech = NULL;
return NULL;
}
return new_speech;