Skip to content

Commit ac494b8

Browse files
committed
rtmpproto: Avoid rare crashes in the fail: codepath in rtmp_open
When running the cleanup in rtmp_close on failures in rtmp_open, we can in rare cases end up using rt->playpath, assuming that it is still set. The crash could happen if we hit the fail codepath in rtmp_open while publishing (rt->is_input == 0) with rt->state set to a value > STATE_FCPUBLISH. This would normally not happen while publishing; either we have an error (and rt->state <= STATE_FCPUBLISH) or we reach rt->state = STATE_PUBLISHING, and then we also return successfully from rtmp_open. The unexpected combination of states could happen if the server responds with e.g. "NetStream.Play.Stop" while expecting "NetStream.Publish.Start"; this sets rt->state to STATE_STOPPED, which also fulfills the condition "> STATE_FCPUBLISH". We don't need to free the rt->playpath/tcurl/flashver strings here; they're handled via AVOption, and thus are freed automatically when the protocol instance is freed (that's why they aren't freed manually within the rtmp_close function either). We also don't need to free the AVDictionary with options; it's owned by the caller. A smaller fix would be to just call rtmp_close before freeing the strings and dictionary, but as we don't need to free them at all, let's remove that redundant code. Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit 8f4819c)
1 parent 31f0084 commit ac494b8

File tree

1 file changed

+0
-4
lines changed

1 file changed

+0
-4
lines changed

libavformat/rtmpproto.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2918,10 +2918,6 @@ static int rtmp_open(URLContext *s, const char *uri, int flags, AVDictionary **o
29182918
return 0;
29192919

29202920
fail:
2921-
av_freep(&rt->playpath);
2922-
av_freep(&rt->tcurl);
2923-
av_freep(&rt->flashver);
2924-
av_dict_free(opts);
29252921
rtmp_close(s);
29262922
return ret;
29272923
}

0 commit comments

Comments
 (0)