Skip to content

Commit b3db450

Browse files
committed
MT#55283 protect against null ssrc_stats
These can be unset for various reasons. Add null checks in appropriate places. closes #1842 Change-Id: Ib428e87775f8b45192aa901f6788ca526578b261 (cherry picked from commit 666fbc3) (cherry picked from commit 8f5d929)
1 parent db6c9fb commit b3db450

File tree

1 file changed

+14
-5
lines changed

1 file changed

+14
-5
lines changed

kernel-module/xt_RTPENGINE.c

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5216,8 +5216,12 @@ static uint32_t rtp_packet_index(struct re_crypto_context *c,
52165216
spin_lock_irqsave(&c->lock, flags);
52175217

52185218
/* rfc 3711 section 3.3.1 */
5219-
index = atomic_read(&ssrc_stats[ssrc_idx]->ext_seq);
5220-
if (unlikely(!index))
5219+
if (ssrc_stats[ssrc_idx]) {
5220+
index = atomic_read(&ssrc_stats[ssrc_idx]->ext_seq);
5221+
if (unlikely(!index))
5222+
index = seq;
5223+
}
5224+
else
52215225
index = seq;
52225226

52235227
/* rfc 3711 appendix A, modified, and sections 3.3 and 3.3.1 */
@@ -5238,7 +5242,8 @@ static uint32_t rtp_packet_index(struct re_crypto_context *c,
52385242
}
52395243

52405244
index = (v << 16) | seq;
5241-
atomic_set(&ssrc_stats[ssrc_idx]->ext_seq, index);
5245+
if (ssrc_stats[ssrc_idx])
5246+
atomic_set(&ssrc_stats[ssrc_idx]->ext_seq, index);
52425247

52435248
spin_unlock_irqrestore(&c->lock, flags);
52445249

@@ -5252,7 +5257,8 @@ static void update_packet_index(struct re_crypto_context *c,
52525257
if (ssrc_idx < 0)
52535258
ssrc_idx = 0;
52545259

5255-
atomic_set(&ssrc_stats[ssrc_idx]->ext_seq, idx);
5260+
if (ssrc_stats[ssrc_idx])
5261+
atomic_set(&ssrc_stats[ssrc_idx]->ext_seq, idx);
52565262
}
52575263

52585264
static int srtp_hash(unsigned char *hmac,
@@ -6159,6 +6165,9 @@ static void rtp_stats(struct rtpengine_target *g, struct rtp_parsed *rtp, s64 ar
61596165
int32_t d;
61606166
uint32_t new_seq;
61616167

6168+
if (!s)
6169+
return;
6170+
61626171
uint16_t seq = ntohs(rtp->rtp_header->seq_num);
61636172
uint32_t ts = ntohl(rtp->rtp_header->timestamp);
61646173

@@ -6378,7 +6387,7 @@ static unsigned int rtpengine46(struct sk_buff *skb, struct sk_buff *oskb,
63786387
if (g->target.pt_filter)
63796388
goto out;
63806389
}
6381-
else if (ssrc_idx >= 0) {
6390+
else if (ssrc_idx >= 0 && g->target.ssrc_stats[ssrc_idx]) {
63826391
atomic_set(&g->target.ssrc_stats[ssrc_idx]->last_pt,
63836392
g->target.pt_stats[rtp_pt_idx]->payload_type);
63846393
atomic64_set(&g->target.ssrc_stats[ssrc_idx]->last_packet, packet_ts);

0 commit comments

Comments
 (0)