[core] Fixed fallback for memory allocation errors (#1459)

Haivision · Aug 13, 2020 · 7e4554f · 7e4554f
1 parent 055375a
commit 7e4554f
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 19 deletions.
diff --git a/srtcore/api.cpp b/srtcore/api.cpp
@@ -2499,11 +2499,7 @@ void CUDTUnited::removeSocket(const SRTSOCKET u)
       // being currently done in the queues, if any.
       mx.m_pSndQueue->setClosing();
       mx.m_pRcvQueue->setClosing();
-      delete mx.m_pSndQueue;
-      delete mx.m_pRcvQueue;
-      mx.m_pChannel->close();
-      delete mx.m_pTimer;
-      delete mx.m_pChannel;
+      mx.destroy();
       m_mMultiplexer.erase(m);
    }
 }
@@ -2562,16 +2558,16 @@ void CUDTUnited::updateMux(
    m.m_bReusable = s->m_pUDT->m_bReuseAddr;
    m.m_iID = s->m_SocketID;
 
-   m.m_pChannel = new CChannel();
-   m.m_pChannel->setIpTTL(s->m_pUDT->m_iIpTTL);
-   m.m_pChannel->setIpToS(s->m_pUDT->m_iIpToS);
-   m.m_pChannel->setSndBufSize(s->m_pUDT->m_iUDPSndBufSize);
-   m.m_pChannel->setRcvBufSize(s->m_pUDT->m_iUDPRcvBufSize);
-   if (s->m_pUDT->m_iIpV6Only != -1)
-      m.m_pChannel->setIpV6Only(s->m_pUDT->m_iIpV6Only);
-
    try
    {
+       m.m_pChannel = new CChannel();
+       m.m_pChannel->setIpTTL(s->m_pUDT->m_iIpTTL);
+       m.m_pChannel->setIpToS(s->m_pUDT->m_iIpToS);
+       m.m_pChannel->setSndBufSize(s->m_pUDT->m_iUDPSndBufSize);
+       m.m_pChannel->setRcvBufSize(s->m_pUDT->m_iUDPRcvBufSize);
+       if (s->m_pUDT->m_iIpV6Only != -1)
+           m.m_pChannel->setIpV6Only(s->m_pUDT->m_iIpV6Only);
+
        if (udpsock)
        {
            // In this case, addr contains the address
@@ -2617,15 +2613,13 @@ void CUDTUnited::updateMux(
    }
    catch (CUDTException& e)
    {
-      m.m_pChannel->close();
-      delete m.m_pChannel;
-      throw;
+       m.destroy();
+       throw;
    }
    catch (...)
    {
-      m.m_pChannel->close();
-      delete m.m_pChannel;
-      throw CUDTException(MJ_SYSTEMRES, MN_MEMORY, 0);
+       m.destroy();
+       throw CUDTException(MJ_SYSTEMRES, MN_MEMORY, 0);
    }
 
    HLOGF(mglog.Debug, 

diff --git a/srtcore/queue.cpp b/srtcore/queue.cpp
@@ -1682,3 +1682,18 @@ void CRcvQueue::storePkt(int32_t id, CPacket *pkt)
         i->second.push(pkt);
     }
 }
+
+
+void CMultiplexer::destroy()
+{
+    // Reverse order of the assigned 
+    delete m_pRcvQueue;
+    delete m_pSndQueue;
+    delete m_pTimer;
+
+    if (m_pChannel)
+    {
+        m_pChannel->close();
+        delete m_pChannel;
+    }
+}
diff --git a/srtcore/queue.h b/srtcore/queue.h
@@ -547,6 +547,18 @@ struct CMultiplexer
    bool m_bReusable;    // if this one can be shared with others
 
    int m_iID;           // multiplexer ID
+
+   // Constructor should reset all pointers to NULL
+   // to prevent dangling pointer when checking for memory alloc fails
+   CMultiplexer()
+       : m_pSndQueue(NULL)
+       , m_pRcvQueue(NULL)
+       , m_pChannel(NULL)
+       , m_pTimer(NULL)
+    {
+    }
+
+   void destroy();
 };
 
 #endif