Bug 1581950: Prevent nr_ice_component_insert_pair from leaking. r=mjf, a=RyanVM
authorByron Campen [:bwc] <docfaraday@gmail.com>
Wed, 18 Sep 2019 22:00:13 +0000
changeset 555265 99c61c3e15a19886b667b02dc157c7ea2a3d731a
parent 555264 57e9358e143d4cd6ddbbaa4b4d37249fe57923b6
child 555266 2a42a19c5deafd8556f4836014169c41b067e186
push id2165
push userffxbld-merge
push dateMon, 14 Oct 2019 16:30:58 +0000
treeherdermozilla-release@0eae18af659f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmjf, RyanVM
bugs1581950
milestone70.0
Bug 1581950: Prevent nr_ice_component_insert_pair from leaking. r=mjf, a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D46231
media/mtransport/third_party/nICEr/src/ice/ice_component.c
--- a/media/mtransport/third_party/nICEr/src/ice/ice_component.c
+++ b/media/mtransport/third_party/nICEr/src/ice/ice_component.c
@@ -949,17 +949,16 @@ static int nr_ice_component_process_inco
            &pair)) {
         *error=(r==R_NO_MEMORY)?500:400;
         ABORT(r);
       }
 
       nr_ice_candidate_pair_set_state(pair->pctx,pair,NR_ICE_PAIR_STATE_FROZEN);
       if(r=nr_ice_component_insert_pair(comp,pair)) {
         *error=(r==R_NO_MEMORY)?500:400;
-        nr_ice_candidate_pair_destroy(&pair);
         ABORT(r);
       }
 
       /* Do this last, since any call to ABORT will destroy pcand */
       TAILQ_INSERT_TAIL(&comp->candidates,pcand,entry_comp);
       pcand=0;
 
       /* Finally start the trigger check if needed */
@@ -1674,43 +1673,49 @@ int nr_ice_component_finalize(nr_ice_com
 
     return(0);
   }
 
 
 int nr_ice_component_insert_pair(nr_ice_component *pcomp, nr_ice_cand_pair *pair)
   {
     int r,_status;
+    int pair_inserted=0;
 
     /* Pairs for peer reflexive are marked SUCCEEDED immediately */
     if (pair->state != NR_ICE_PAIR_STATE_FROZEN &&
         pair->state != NR_ICE_PAIR_STATE_SUCCEEDED){
       assert(0);
       ABORT(R_BAD_ARGS);
     }
 
     if(r=nr_ice_candidate_pair_insert(&pair->remote->stream->check_list,pair))
       ABORT(r);
 
+    pair_inserted=1;
+
     /* Make sure the check timer is running, if the stream was previously
      * started. We will not start streams just because a pair was created,
      * unless it is the first pair to be created across all streams. */
     r_log(LOG_ICE,LOG_DEBUG,"ICE-PEER(%s)/CAND-PAIR(%s): Ensure that check timer is running for new pair %s.",pair->remote->stream->pctx->label, pair->codeword, pair->as_string);
 
     if(pair->remote->stream->ice_state == NR_ICE_MEDIA_STREAM_CHECKS_ACTIVE ||
        (pair->remote->stream->ice_state == NR_ICE_MEDIA_STREAM_CHECKS_FROZEN &&
         !pair->remote->stream->pctx->checks_started)){
       if(nr_ice_media_stream_start_checks(pair->remote->stream->pctx, pair->remote->stream)) {
         r_log(LOG_ICE,LOG_WARNING,"ICE-PEER(%s)/CAND-PAIR(%s): Could not restart checks for new pair %s.",pair->remote->stream->pctx->label, pair->codeword, pair->as_string);
         ABORT(R_INTERNAL);
       }
     }
 
     _status=0;
   abort:
+    if (_status && !pair_inserted) {
+      nr_ice_candidate_pair_destroy(&pair);
+    }
     return(_status);
   }
 
 int nr_ice_component_get_default_candidate(nr_ice_component *comp, nr_ice_candidate **candp, int ip_version)
   {
     int _status;
     nr_ice_candidate *cand;
     nr_ice_candidate *best_cand = NULL;