From 467dfe0e7c28c52f65af414474677f4b43f9dc10 Mon Sep 17 00:00:00 2001 From: "stefan@webrtc.org" Date: Mon, 19 Nov 2012 11:49:37 +0000 Subject: [PATCH] Fix possible race condition and access into an empty list. TBR=mflodman@webrtc.org BUG= Review URL: https://webrtc-codereview.appspot.com/939021 git-svn-id: http://webrtc.googlecode.com/svn/trunk@3131 4adac7df-926f-26a2-2b94-8c16560cd09d --- webrtc/video_engine/vie_remb.cc | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/webrtc/video_engine/vie_remb.cc b/webrtc/video_engine/vie_remb.cc index 72bbbaa0df..ea795ac18f 100644 --- a/webrtc/video_engine/vie_remb.cc +++ b/webrtc/video_engine/vie_remb.cc @@ -158,7 +158,8 @@ WebRtc_Word32 VieRemb::Process() { bitrate_ = 0; bitrate_update_time_ms_ = -1; } - if (bitrate_update_time_ms_ == -1 || ssrcs_.empty()) { + if (bitrate_update_time_ms_ == -1 || ssrcs_.empty() || + receive_modules_.empty()) { list_crit_->Leave(); return 0; } @@ -176,12 +177,19 @@ WebRtc_Word32 VieRemb::Process() { if (last_send_bitrate_ < kRembMinimumBitrateKbps) { last_send_bitrate_ = kRembMinimumBitrateKbps; } + // Copy SSRCs to avoid race conditions. + int ssrcs_length = ssrcs_.size(); + unsigned int* ssrcs = new unsigned int[ssrcs_length]; + for (int i = 0; i < ssrcs_length; ++i) { + ssrcs[i] = ssrcs_[i]; + } list_crit_->Leave(); if (sender) { // TODO(holmer): Change RTP module API to take a vector pointer. - sender->SetREMBData(bitrate_, ssrcs_.size(), &ssrcs_[0]); + sender->SetREMBData(bitrate_, ssrcs_length, ssrcs); } + delete [] ssrcs; return 0; }