On Sun, 11. Oct 21:28, Andreas Rheinhardt wrote:
> Andriy Gelman:
> > From: Andriy Gelman <andriy.gel...@gmail.com>
> >
> > Otherwise a double free will occur in case rtsp_read_close() is called
> > on error.
> >
> > Signed-off-by: Andriy Gelman <andriy.gel...@gmail.com>
> > ---
> > libavformat/rtspdec.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
> > index ef084a8b2b..b519b6f1a2 100644
> > --- a/libavformat/rtspdec.c
> > +++ b/libavformat/rtspdec.c
> > @@ -691,7 +691,8 @@ static int rtsp_listen(AVFormatContext *s)
> > } else if (methodcode == SETUP)
> > ret = rtsp_read_setup(s, host, uri);
> > if (ret) {
> > - ffurl_close(rt->rtsp_hd);
> > + ffurl_closep(&rt->rtsp_hd);
> > + rt->rtsp_hd_out = NULL;
> > return AVERROR_INVALIDDATA;
> > }
> > }
> >
> You simply set rtsp_hd_out to NULL, so I presume you have checked that
> it really always pointed to NULL or to rtsp_hd (i.e. that everything is
> consistent) before that. In this case, you don't need new code for
> freeing here: Remove the ffurl_close() that is already here and leave
> freeing to rtsp_read_close() (and ultimately to
> ff_rtsp_close_connections()). This advice is untested, so better test it.
Yes, in listen mode rtsp_hd = rtsp_hd_out.
A separate allocation is done in connect mode.
I'll add your suggestion to the second patch and drop this one.
Thanks,
--
Andriy
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
