Преглед изворни кода

rtpengine: init rtp engine sockets array after allocation

- it can result in closing the random values found in memory, which can
  overlap with valid sockets, due to follow up execution of
  build_rtpp_socks()
- do not init sockets for PROC_MAIN (for for=yes) and PROC_INIT to avoid
  duplicating sockets with child processed
Daniel-Constantin Mierla пре 9 година
родитељ
комит
d76761bf95
1 измењених фајлова са 8 додато и 0 уклоњено
  1. 8 0
      modules/rtpengine/rtpengine.c

+ 8 - 0
modules/rtpengine/rtpengine.c

@@ -1809,6 +1809,7 @@ static int build_rtpp_socks(unsigned int current_rtpp_no) {
 	for (i = 0; i < rtpp_socks_size; i++) {
 		if (rtpp_socks[i] >= 0) {
 			close(rtpp_socks[i]);
+			rtpp_socks[i] = -1;
 		}
 	}
 
@@ -1818,6 +1819,7 @@ static int build_rtpp_socks(unsigned int current_rtpp_no) {
 		LM_ERR("no more pkg memory for rtpp_socks\n");
 		return -1;
 	}
+	memset(rtpp_socks, -1, sizeof(int)*(rtpp_socks_size));
 
 	lock_get(rtpp_set_list->rset_head_lock);
 	for (rtpp_list = rtpp_set_list->rset_first; rtpp_list != 0;
@@ -1911,6 +1913,11 @@ child_init(int rank)
 	if(!rtpp_set_list)
 		return 0;
 
+	/* do not init sockets for PROC_INIT and main process when fork=yes */
+	if(rank==PROC_INIT || (rank==PROC_MAIN && dont_fork==0)) {
+		return 0;
+	}
+
 	mypid = getpid();
 
 	lock_get(rtpp_no_lock);
@@ -1921,6 +1928,7 @@ child_init(int rank)
 	if (!rtpp_socks) {
 		return -1;
 	}
+	memset(rtpp_socks, -1, sizeof(int)*(rtpp_socks_size));
 
 	// vector of pointers to queried nodes
 	queried_nodes_ptr = (struct rtpp_node**)pkg_malloc(queried_nodes_limit * sizeof(struct rtpp_node*));