From ab835fe86efd94a5ecf2b3b50fe6f4d1d494b74e Mon Sep 17 00:00:00 2001 From: Alex Henrie Date: Fri, 20 Mar 2020 12:18:30 -0600 Subject: [PATCH] Fix bad frees in error paths of WebRtcAecm_Create The error paths free the memory referenced by each pointer in the struct, but if the pointers are not initialized, random memory belonging to other parts of the program could be freed instead. Zero out the entire struct as soon as it is allocated to ensure that nothing is freed if there is nothing to free. Bug: webrtc:11446 Change-Id: I8a2985d1388477339351aa03107ee68925372d49 Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/171121 Commit-Queue: Karl Wiberg Reviewed-by: Karl Wiberg Cr-Commit-Position: refs/heads/master@{#30852} --- AUTHORS | 1 + modules/audio_processing/aecm/aecm_core.cc | 3 ++- modules/audio_processing/aecm/echo_control_mobile.cc | 5 ++--- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/AUTHORS b/AUTHORS index d306c51fa0..ae9d4e2e14 100644 --- a/AUTHORS +++ b/AUTHORS @@ -3,6 +3,7 @@ Adam Fedor Akshay Shah +Alex Henrie Alexander Brauckmann Alexandre Gouaillard Andrew MacDonald diff --git a/modules/audio_processing/aecm/aecm_core.cc b/modules/audio_processing/aecm/aecm_core.cc index 09c55be81a..78c013323a 100644 --- a/modules/audio_processing/aecm/aecm_core.cc +++ b/modules/audio_processing/aecm/aecm_core.cc @@ -187,7 +187,8 @@ StoreAdaptiveChannel WebRtcAecm_StoreAdaptiveChannel; ResetAdaptiveChannel WebRtcAecm_ResetAdaptiveChannel; AecmCore* WebRtcAecm_CreateCore() { - AecmCore* aecm = static_cast(malloc(sizeof(AecmCore))); + // Allocate zero-filled memory. + AecmCore* aecm = static_cast(calloc(1, sizeof(AecmCore))); aecm->farFrameBuf = WebRtc_CreateBuffer(FRAME_LEN + PART_LEN, sizeof(int16_t)); diff --git a/modules/audio_processing/aecm/echo_control_mobile.cc b/modules/audio_processing/aecm/echo_control_mobile.cc index 506c7930df..14522c0f1d 100644 --- a/modules/audio_processing/aecm/echo_control_mobile.cc +++ b/modules/audio_processing/aecm/echo_control_mobile.cc @@ -89,7 +89,8 @@ static int WebRtcAecm_EstBufDelay(AecMobile* aecm, short msInSndCardBuf); static int WebRtcAecm_DelayComp(AecMobile* aecm); void* WebRtcAecm_Create() { - AecMobile* aecm = static_cast(malloc(sizeof(AecMobile))); + // Allocate zero-filled memory. + AecMobile* aecm = static_cast(calloc(1, sizeof(AecMobile))); aecm->aecmCore = WebRtcAecm_CreateCore(); if (!aecm->aecmCore) { @@ -103,8 +104,6 @@ void* WebRtcAecm_Create() { return NULL; } - aecm->initFlag = 0; - #ifdef AEC_DEBUG aecm->aecmCore->farFile = fopen("aecFar.pcm", "wb"); aecm->aecmCore->nearFile = fopen("aecNear.pcm", "wb");