On Thu, May 15, 2014 at 10:29:10AM +0200, Jacob Erlbeck wrote:

Hi,

> +static int set_audio_info(void *ctx, struct mgcp_rtp_end *rtp,
> +                       int payload_type, const char *audio_name)
> +{
...

> +     talloc_free(rtp->subtype_name);
> +     rtp->subtype_name = NULL;
> +     talloc_free(rtp->audio_name);
> +     rtp->audio_name = NULL;
...



> @@ -600,29 +646,18 @@ static int parse_sdp_data(struct mgcp_rtp_end *rtp, 
> struct mgcp_parse_data *p)
...

> +                             set_audio_info(p->cfg, rtp, payload, 
> audio_name);
>                       } else if (sscanf(line, "a=ptime:%d-%d",
...
> +                             set_audio_info(p->cfg, rtp, audio_payload, 
> NULL);


> -     endp->bts_end.payload_type = tcfg->audio_payload;
> +     set_audio_info(p->cfg, &endp->bts_end, tcfg->audio_payload, 
> tcfg->audio_name);


I raised this before as well. So for a

 CRCX
 MDCX
 DLCX

procedure. We might have endp->bts_end->subtype_name still with an
allocated string. Please make reset endpoint give up all the data.

Reply via email to