zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix bad frees in error paths of WebRtcAecm_Create

Browse Source 
The error paths free the memory referenced by each pointer in the
struct, but if the pointers are not initialized, random memory belonging
to other parts of the program could be freed instead. Zero out the
entire struct as soon as it is allocated to ensure that nothing is freed
if there is nothing to free.

Bug: webrtc:11446
Change-Id: I8a2985d1388477339351aa03107ee68925372d49
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/171121
Commit-Queue: Karl Wiberg <kwiberg@webrtc.org>
Reviewed-by: Karl Wiberg <kwiberg@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#30852}
This commit is contained in:
Alex Henrie
2020-03-20 12:18:30 -06:00
committed by Commit Bot
parent 8515d5a4ab
commit ab835fe86e
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
AUTHORS
View File

@ -3,6 +3,7 @@
Adam Fedor <adam.fedor@gmail.com>
Akshay Shah <meetakshay99@gmail.com>
Alex Henrie <alexhenrie24@gmail.com>
Alexander Brauckmann <a.brauckmann@gmail.com>
Alexandre Gouaillard <agouaillard@gmail.com>
Andrew MacDonald <andrew@webrtc.org>

3
modules/audio_processing/aecm/aecm_core.cc
View File

@ -187,7 +187,8 @@ StoreAdaptiveChannel WebRtcAecm_StoreAdaptiveChannel;
ResetAdaptiveChannel WebRtcAecm_ResetAdaptiveChannel;
AecmCore* WebRtcAecm_CreateCore() {
AecmCore* aecm = static_cast<AecmCore*>(malloc(sizeof(AecmCore)));
// Allocate zero-filled memory.
AecmCore* aecm = static_cast<AecmCore*>(calloc(1, sizeof(AecmCore)));
aecm->farFrameBuf =
WebRtc_CreateBuffer(FRAME_LEN + PART_LEN, sizeof(int16_t));

5
modules/audio_processing/aecm/echo_control_mobile.cc
View File

@ -89,7 +89,8 @@ static int WebRtcAecm_EstBufDelay(AecMobile* aecm, short msInSndCardBuf);
static int WebRtcAecm_DelayComp(AecMobile* aecm);
void* WebRtcAecm_Create() {
AecMobile* aecm = static_cast<AecMobile*>(malloc(sizeof(AecMobile)));
// Allocate zero-filled memory.
AecMobile* aecm = static_cast<AecMobile*>(calloc(1, sizeof(AecMobile)));
aecm->aecmCore = WebRtcAecm_CreateCore();
if (!aecm->aecmCore) {
@ -103,8 +104,6 @@ void* WebRtcAecm_Create() {
return NULL;
}
aecm->initFlag = 0;
#ifdef AEC_DEBUG
aecm->aecmCore->farFile = fopen("aecFar.pcm", "wb");
aecm->aecmCore->nearFile = fopen("aecNear.pcm", "wb");