Fix memory leak in video_coding::PacketBuffer::InsertPacket.

webrtc/modules/video_coding/packet_buffer.cc

 /*
  *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 38 matching lines @@
   RTC_DCHECK_LE(start_buffer_size, max_buffer_size);
   // Buffer size must always be a power of 2.
   RTC_DCHECK((start_buffer_size & (start_buffer_size - 1)) == 0);
   RTC_DCHECK((max_buffer_size & (max_buffer_size - 1)) == 0);
 }
 
 PacketBuffer::~PacketBuffer() {
   Clear();
 }
 
-bool PacketBuffer::InsertPacket(const VCMPacket& packet) {
+bool PacketBuffer::InsertPacket(VCMPacket* packet) {
   std::vector<std::unique_ptr<RtpFrameObject>> found_frames;
   {
     rtc::CritScope lock(&crit_);
-    uint16_t seq_num = packet.seqNum;
+    uint16_t seq_num = packet->seqNum;
     size_t index = seq_num % size_;
 
     if (!first_packet_received_) {
       first_seq_num_ = seq_num;
       last_seq_num_ = seq_num;
       first_packet_received_ = true;
     } else if (AheadOf(first_seq_num_, seq_num)) {
       // If we have explicitly cleared past this packet then it's old,
       // don't insert it.
-      if (is_cleared_to_first_seq_num_)
+      if (is_cleared_to_first_seq_num_) {
+        delete[] packet->dataPtr;
+        packet->dataPtr = nullptr;
         return false;
+      }
 
       first_seq_num_ = seq_num;
     }
 
     if (sequence_buffer_[index].used) {
-      // Duplicate packet, do nothing.
-      if (data_buffer_[index].seqNum == packet.seqNum)
+      // Duplicate packet, just delete the payload.
+      if (data_buffer_[index].seqNum == packet->seqNum) {
+        delete[] packet->dataPtr;
+        packet->dataPtr = nullptr;
         return true;
+      }
 
       // The packet buffer is full, try to expand the buffer.
       while (ExpandBufferSize() && sequence_buffer_[seq_num % size_].used) {
       }
       index = seq_num % size_;
 
       // Packet buffer is still full.
-      if (sequence_buffer_[index].used)
+      if (sequence_buffer_[index].used) {
+        delete[] packet->dataPtr;
+        packet->dataPtr = nullptr;
         return false;
+      }
     }
 
     if (AheadOf(seq_num, last_seq_num_))
       last_seq_num_ = seq_num;
 
-    sequence_buffer_[index].frame_begin = packet.isFirstPacket;
-    sequence_buffer_[index].frame_end = packet.markerBit;
-    sequence_buffer_[index].seq_num = packet.seqNum;
+    sequence_buffer_[index].frame_begin = packet->isFirstPacket;
+    sequence_buffer_[index].frame_end = packet->markerBit;
+    sequence_buffer_[index].seq_num = packet->seqNum;
     sequence_buffer_[index].continuous = false;
     sequence_buffer_[index].frame_created = false;
     sequence_buffer_[index].used = true;
-    data_buffer_[index] = packet;
+    data_buffer_[index] = *packet;
+    packet->dataPtr = nullptr;
 
     found_frames = FindFrames(seq_num);
   }
 
   for (std::unique_ptr<RtpFrameObject>& frame : found_frames)
     received_frame_callback_->OnReceivedFrame(std::move(frame));
 
   return true;
 }
 
@@ skipping 169 matching lines @@
 int PacketBuffer::Release() const {
   int count = rtc::AtomicOps::Decrement(&ref_count_);
   if (!count) {
     delete this;
   }
   return count;
 }
 
 }  // namespace video_coding
 }  // namespace webrtc