bug in wav_player.c?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Bernie B wrote:
> Hi,
> 
> First of all @ Benny & team: great job, I do like your libraries, their 
> design and their features. Thanks for sharing it and your marvelous support.
> 
> Here may be a bug: In method fill_buffer() inside 'wav_player.c' of 
> pjmedia there is the following comment:
>             /* This will crash if file port is destroyed in the
>              * callback, that's why we set the eof flag before
>              * calling the callback:
>              fport->eof = PJ_TRUE;
>             */
> But right after that, fport is used again (lots of fport->...). Inside 

True, but only when the callback returns PJ_SUCCESS!

> my application's EOF callback method [set up via: pjsua_player_create(), 
> pjsua_player_get_port(), and pjmedia_wav_player_set_eof_cb()], 
> pjsua_player_destroy() is called, eventually. pjsua_player_destroy() 
> seems to make some or all content of fport invalid which results in a 
> program crash (illegal memory access) when returning. I don't see any 
> other place than inside the cb method to call pjsua_player_destroy(). Is 
> this correct?

The convention is, if you destroy the player inside the callback,
you must return non-zero (e.g. -1) from the callback so that pjmedia
knows that the player is no longer exist. Thus pjmedia will not try
to do anything else with it.

I'm sure this has been documented somewhere. ;-)

cheers,
  -benny


> Cheers,
> Bernie








[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux