diff options
| author | Taylor Brandstetter <deadbeef@webrtc.org> | 2020-10-27 18:57:39 -0700 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2021-02-16 12:31:22 +0000 |
| commit | c9e156a8ff083dd3732c08324ccc22bfcf16a0b9 (patch) | |
| tree | d270d5a357314feb969a9e411c05bb9284de356c /chromium/third_party | |
| parent | e39d925037a8fb30aa1fa394e8c0d2a8286b7f74 (diff) | |
| download | qtwebengine-chromium-c9e156a8ff083dd3732c08324ccc22bfcf16a0b9.tar.gz | |
[Backport] Security bug 1127774
Cherry-pick of patch originally reviewed on
https://webrtc-review.googlesource.com/c/src/+/190640:
Free data if SCTP packet is delivered after transport destruction.
Follow up to:
https://webrtc-review.googlesource.com/c/src/+/184240
Bug: chromium:1127774
Change-Id: I1595d306f026f9d90cf71d8729133e46c2766c6f
Reviewed-by: Harald Alvestrand <hta@webrtc.org>
Commit-Queue: Taylor <deadbeef@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#32526}
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
Diffstat (limited to 'chromium/third_party')
| -rw-r--r-- | chromium/third_party/webrtc/media/sctp/sctp_transport.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/chromium/third_party/webrtc/media/sctp/sctp_transport.cc b/chromium/third_party/webrtc/media/sctp/sctp_transport.cc index a74c66431c1..13e7db49ce5 100644 --- a/chromium/third_party/webrtc/media/sctp/sctp_transport.cc +++ b/chromium/third_party/webrtc/media/sctp/sctp_transport.cc @@ -398,6 +398,7 @@ class SctpTransport::UsrSctpWrapper { RTC_LOG(LS_ERROR) << "OnSctpInboundPacket: Failed to get transport for socket " << sock << "; possibly was already destroyed."; + free(data); return 0; } // Sanity check that both methods of getting the SctpTransport pointer |