Changeset 6070

Timestamp:

Sep 23, 2019 7:24:24 AM (5 years ago)

Author:

ming

Message:

Fixed #2231: Potential premature buffer reuse in UDP media transport

File:

• pjproject/trunk/pjmedia/src/pjmedia/transport_udp.c (modified) (9 diffs)

pjproject/trunk/pjmedia/src/pjmedia/transport_udp.c

@@ -43 +43 @@
     char                buffer[PJMEDIA_MAX_MTU];
     pj_ioqueue_op_key_t op_key;
+    pj_bool_t           is_pending;
 } pending_write;
 
@@ -99 +100 @@
                        pj_ioqueue_op_key_t *op_key, 
                        pj_ssize_t bytes_read);
+static void on_rtp_data_sent(pj_ioqueue_key_t *key, 
+                             pj_ioqueue_op_key_t *op_key, 
+                             pj_ssize_t bytes_sent);
 static void on_rx_rtcp(pj_ioqueue_key_t *key, 
                        pj_ioqueue_op_key_t *op_key, 
@@ -339 +343 @@
     pj_bzero(&rtp_cb, sizeof(rtp_cb));
     rtp_cb.on_read_complete = &on_rx_rtp;
+    rtp_cb.on_write_complete = &on_rtp_data_sent;
 
     status = pj_ioqueue_register_sock(pool, ioqueue, tp->rtp_sock, tp,
@@ -353 +358 @@
 
     pj_ioqueue_op_key_init(&tp->rtp_read_op, sizeof(tp->rtp_read_op));
-    for (i=0; i<PJ_ARRAY_SIZE(tp->rtp_pending_write); ++i)
+    for (i=0; i<PJ_ARRAY_SIZE(tp->rtp_pending_write); ++i) {
+        tp->rtp_pending_write[i].is_pending = PJ_FALSE;
         pj_ioqueue_op_key_init(&tp->rtp_pending_write[i].op_key, 
                                sizeof(tp->rtp_pending_write[i].op_key));
+    }
 
 #if 0 // See #2097: move read op kick-off to media_start()
@@ -619 +626 @@
 }
 
+static void on_rtp_data_sent(pj_ioqueue_key_t *key, 
+                             pj_ioqueue_op_key_t *op_key, 
+                             pj_ssize_t bytes_sent)
+{
+    struct transport_udp *udp;
+    unsigned i;
+
+    PJ_UNUSED_ARG(bytes_sent);
+
+    udp = (struct transport_udp*) pj_ioqueue_get_user_data(key);
+
+    for (i = 0; i < PJ_ARRAY_SIZE(udp->rtp_pending_write); ++i) {
+        if (&udp->rtp_pending_write[i].op_key == op_key) {
+            udp->rtp_pending_write[i].is_pending = PJ_FALSE;
+            break;
+        }
+    }
+}
 
 /* Notification from ioqueue about incoming RTCP packet */
@@ -959 +984 @@
             pj_ioqueue_post_completion(udp->rtp_key,
                                        &udp->rtp_pending_write[i].op_key, 0);
+            udp->rtp_pending_write[i].is_pending = PJ_FALSE;
         }
         pj_ioqueue_post_completion(udp->rtcp_key, &udp->rtcp_write_op, 0);
@@ -1003 +1029 @@
     id = udp->rtp_write_op_id;
     pw = &udp->rtp_pending_write[id];
+    if (pw->is_pending) {
+        /* There is still currently pending operation for this buffer. */
+        PJ_LOG(4,(udp->base.name, "Too many pending write operations"));
+        return PJ_EBUSY;
+    }
+    pw->is_pending = PJ_TRUE;
 
     /* We need to copy packet to our buffer because when the
@@ -1016 +1048 @@
                                 &udp->rem_rtp_addr, 
                                 udp->addr_len);
+
+    if (status != PJ_EPENDING) {
+        /* Send operation has completed immediately. Clear the flag. */
+        pw->is_pending = PJ_FALSE;
+    }
 
     udp->rtp_write_op_id = (udp->rtp_write_op_id + 1) %
@@ -1308 +1345 @@
 #endif
     pj_bzero(&cb, sizeof(cb));
-    if (is_rtp)
+    if (is_rtp) {
         cb.on_read_complete = &on_rx_rtp;
-    else 
+        cb.on_write_complete = &on_rtp_data_sent;
+    } else {
         cb.on_read_complete = &on_rx_rtcp;
+    }
 
     if (is_rtp) {