From b6db7da98af264b55161bc93e6020fe404cfc627 Mon Sep 17 00:00:00 2001 From: Fedor Date: Wed, 27 May 2020 09:01:53 +0300 Subject: Issue #1558 - Prevent null deref crash in WebrtcVideoConduit DTOR --- media/webrtc/signaling/src/media-conduit/VideoConduit.cpp | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'media') diff --git a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp index b406fded5..95f599be4 100755 --- a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp +++ b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp @@ -521,6 +521,8 @@ WebrtcVideoConduit::DeleteStreams() mVideoCodecStat->EndOfCallStats(); } mVideoCodecStat = nullptr; + //This does Release AudioConduit before mPtrViEBase set nullptr. + SyncTo(nullptr); // We can't delete the VideoEngine until all these are released! // And we can't use a Scoped ptr, since the order is arbitrary mPtrViEBase = nullptr; @@ -543,6 +545,11 @@ WebrtcVideoConduit::SyncTo(WebrtcAudioConduit *aConduit) { CSFLogDebug(logTag, "%s Synced to %p", __FUNCTION__, aConduit); + if (!mPtrViEBase) { + // ViEBase has already been released; we no longer have a conduit. + mSyncedTo = nullptr; + return; + } // SyncTo(value) syncs to the AudioConduit, and if already synced replaces // the current sync target. SyncTo(nullptr) cancels any existing sync and // releases the strong ref to AudioConduit. -- cgit v1.2.3