diff mbox series

[FFmpeg-devel,2/2] avformat/rtspdec: fix potential mem leak in listen mode

Message ID 20201127001653.67116-2-andriy.gelman@gmail.com
State Superseded
Headers show
Series [FFmpeg-devel,1/2] avformat/rtspdec: show method request in log | expand

Checks

Context Check Description
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished

Commit Message

Andriy Gelman Nov. 27, 2020, 12:16 a.m. UTC 
From: Andriy Gelman <andriy.gelman@gmail.com>

Currently a repeating setup request (with the same stream id) will
simply overwrite rtp_handle/transport_priv without freeing the
resources first. This is fixed by closing the previous setup request.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
---
 libavformat/rtspdec.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
diff mbox series

Patch

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index be11576913..4352a94376 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -274,6 +274,16 @@  static int rtsp_read_setup(AVFormatContext *s, char* host, char *controlurl)
     rtsp_st   = rt->rtsp_streams[streamid];
     localport = rt->rtp_port_min;
 
+    /* check if the stream has already been setup */
+    if (rtsp_st->rtp_handle || rtsp_st->transport_priv) {
+        if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RDT)
+            ff_rdt_parse_close(rtsp_st->transport_priv);
+        else if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RTP)
+            ff_rtp_parse_close(rtsp_st->transport_priv);
+        rtsp_st->transport_priv = NULL;
+        ffurl_closep(&rtsp_st->rtp_handle);
+    }
+
     if (request.transports[0].lower_transport == RTSP_LOWER_TRANSPORT_TCP) {
         rt->lower_transport = RTSP_LOWER_TRANSPORT_TCP;
         if ((ret = ff_rtsp_open_transport_ctx(s, rtsp_st))) {