Skip to content

Commit 8db338b

Browse files
authored
fix(simplestream): move json_length to outer scope to prevent dangling pointer (#1107)
In sendJSON mode, `uint32_t json_length` was declared inside the `if (stream.sendJSON==true)` block, but the `send_to()`/`send()` call that reads from the scatter-gather buffer is outside that block. By the time the UDP send executes, `json_length` has gone out of scope and its stack memory may be reclaimed — causing the 4-byte length prefix in the packet to contain garbage data instead of the actual JSON length. Move `json_length` to the same scope as `send_buffer` so it remains alive at send time. Fixes all three affected functions: `audio_stream`, `call_start`, and `call_end`. Fixes #1106
1 parent debaf83 commit 8db338b

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

plugins/simplestream/simplestream.cc

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ class Simple_Stream : public Plugin_Api {
104104
json json_object;
105105
std::string json_string;
106106
std::vector<boost::asio::const_buffer> send_buffer;
107+
uint32_t json_length = 0;
107108
if (stream.sendJSON==true){
108109
//create JSON metadata
109110
json_object = {
@@ -117,7 +118,7 @@ class Simple_Stream : public Plugin_Api {
117118
{"event","audio"},
118119
};
119120
json_string = json_object.dump();
120-
uint32_t json_length = json_string.length(); //determine length in bytes
121+
json_length = json_string.length(); //determine length in bytes
121122
//BOOST_LOG_TRIVIAL(debug) << "json_length is " <<json_length <<" bytes";
122123
send_buffer.push_back(buffer(&json_length,4)); //prepend length of the json data
123124
send_buffer.push_back(buffer(json_string)); //prepend json data
@@ -180,6 +181,7 @@ class Simple_Stream : public Plugin_Api {
180181
json json_object;
181182
std::string json_string;
182183
std::vector<boost::asio::const_buffer> send_buffer;
184+
uint32_t json_length = 0;
183185
if (stream.sendJSON==true){
184186
//create JSON metadata
185187
json_object = {
@@ -194,7 +196,7 @@ class Simple_Stream : public Plugin_Api {
194196
{"event","call_start"},
195197
};
196198
json_string = json_object.dump();
197-
uint32_t json_length = json_string.length(); //determine length in bytes
199+
json_length = json_string.length(); //determine length in bytes
198200
send_buffer.push_back(buffer(&json_length,4)); //prepend length of the json data
199201
send_buffer.push_back(buffer(json_string)); //prepend json data
200202
}
@@ -231,6 +233,7 @@ class Simple_Stream : public Plugin_Api {
231233
json json_object;
232234
std::string json_string;
233235
std::vector<boost::asio::const_buffer> send_buffer;
236+
uint32_t json_length = 0;
234237
if (stream.sendJSON==true){
235238
//create JSON metadata
236239
json_object = {
@@ -241,7 +244,7 @@ class Simple_Stream : public Plugin_Api {
241244
{"event","call_end"},
242245
};
243246
json_string = json_object.dump();
244-
uint32_t json_length = json_string.length(); //determine length in bytes
247+
json_length = json_string.length(); //determine length in bytes
245248
send_buffer.push_back(buffer(&json_length,4)); //prepend length of the json data
246249
send_buffer.push_back(buffer(json_string)); //prepend json data
247250
}

0 commit comments

Comments
 (0)