commit ab835fe86efd94a5ecf2b3b50fe6f4d1d494b74e
author Alex Henrie <alexhenrie24@gmail.com> Fri Mar 20 18:18:30 2020
committer Commit Bot <commit-bot@chromium.org> Sat Mar 21 23:01:47 2020
tree 6b7f8188ae6720a3bc532a14004165c29d3af688
parent 8515d5a4ab4b2e3fd29b0d3ec572db9325262b61

Fix bad frees in error paths of WebRtcAecm_Create

The error paths free the memory referenced by each pointer in the
struct, but if the pointers are not initialized, random memory belonging
to other parts of the program could be freed instead. Zero out the
entire struct as soon as it is allocated to ensure that nothing is freed
if there is nothing to free.

Bug: webrtc:11446
Change-Id: I8a2985d1388477339351aa03107ee68925372d49
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/171121
Commit-Queue: Karl Wiberg <kwiberg@webrtc.org>
Reviewed-by: Karl Wiberg <kwiberg@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#30852}

AUTHORS

diff --git a/AUTHORS b/AUTHORS
index d306c51..ae9d4e2 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -3,6 +3,7 @@
 
 Adam Fedor <adam.fedor@gmail.com>
 Akshay Shah <meetakshay99@gmail.com>
+Alex Henrie <alexhenrie24@gmail.com>
 Alexander Brauckmann <a.brauckmann@gmail.com>
 Alexandre Gouaillard <agouaillard@gmail.com>
 Andrew MacDonald <andrew@webrtc.org>

modules/audio_processing/aecm/aecm_core.cc

diff --git a/modules/audio_processing/aecm/aecm_core.cc b/modules/audio_processing/aecm/aecm_core.cc
index 09c55be..78c0133 100644
--- a/modules/audio_processing/aecm/aecm_core.cc
+++ b/modules/audio_processing/aecm/aecm_core.cc
@@ -187,7 +187,8 @@
 ResetAdaptiveChannel WebRtcAecm_ResetAdaptiveChannel;
 
 AecmCore* WebRtcAecm_CreateCore() {
-  AecmCore* aecm = static_cast<AecmCore*>(malloc(sizeof(AecmCore)));
+  // Allocate zero-filled memory.
+  AecmCore* aecm = static_cast<AecmCore*>(calloc(1, sizeof(AecmCore)));
 
   aecm->farFrameBuf =
       WebRtc_CreateBuffer(FRAME_LEN + PART_LEN, sizeof(int16_t));

modules/audio_processing/aecm/echo_control_mobile.cc

diff --git a/modules/audio_processing/aecm/echo_control_mobile.cc b/modules/audio_processing/aecm/echo_control_mobile.cc
index 506c793..14522c0 100644
--- a/modules/audio_processing/aecm/echo_control_mobile.cc
+++ b/modules/audio_processing/aecm/echo_control_mobile.cc
@@ -89,7 +89,8 @@
 static int WebRtcAecm_DelayComp(AecMobile* aecm);
 
 void* WebRtcAecm_Create() {
-  AecMobile* aecm = static_cast<AecMobile*>(malloc(sizeof(AecMobile)));
+  // Allocate zero-filled memory.
+  AecMobile* aecm = static_cast<AecMobile*>(calloc(1, sizeof(AecMobile)));
 
   aecm->aecmCore = WebRtcAecm_CreateCore();
   if (!aecm->aecmCore) {
@@ -103,8 +104,6 @@
     return NULL;
   }
 
-  aecm->initFlag = 0;
-
 #ifdef AEC_DEBUG
   aecm->aecmCore->farFile = fopen("aecFar.pcm", "wb");
   aecm->aecmCore->nearFile = fopen("aecNear.pcm", "wb");