PR #25160 opened by Ratnaker URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25160 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25160.patch
Repeated `a=rtpmap` attributes for one SDP media stream call `init_rtp_handler()` more than once. For handlers with private data, each call allocates a new `dynamic_protocol_context`; the current assignment overwrites the previous pointer, so teardown can release only the final allocation. This change invokes the current handler's cleanup callback and frees its private context before installing a replacement. Minimal reproducer with an ASan/LSan build: ```sh cat > repeated-rtpmap.sdp <<'EOF' v=0 o=- 0 0 IN IP4 127.0.0.1 s=Repeated mapping ownership test c=IN IP4 127.0.0.1 t=0 0 m=audio 5004 RTP/AVP 0 a=rtpmap:0 mpeg4-generic/48000/2 a=rtpmap:0 mpeg4-generic/48000/2 EOF ASAN_OPTIONS=detect_leaks=1 ./ffprobe -v error \ -sdp_flags custom_io -f sdp \ -show_entries format=format_name \ -of default=noprint_wrappers=1:nokey=1 \ repeated-rtpmap.sdp ``` Before this change, LeakSanitizer reports 8,272 bytes leaked in one allocation. The one-mapping control exits cleanly. LeakSanitizer measured an 8,272-byte leak for one duplicate AAC mapping and 4,061,552 bytes in 491 allocations for a 16,354-byte SDP containing 492 matching mappings. The latter also reproduced through an RTSP `DESCRIBE` response served over loopback. Validation on master `94cba3150c6b83057ed48b833689adc806715cc0`: 1) ASan/UBSan/LSan: one-mapping control, two mappings, and 492 mappings clean after the fix. 2) Public API replay: 100 `avformat_open_input()`/`avformat_close_input()` cycles clean. 3) Loopback RTSP `DESCRIBE`: 16,354-byte SDP parsed without a sanitizer report. 4) RTSP listen mode: repeated mappings in `ANNOUNCE` followed by `SETUP` accepted without a sanitizer report. 5) Reduced configuration `make fate`: all 209 enabled tests passed (no external FATE samples configured). 6) `tools/patcheck`: no code-style findings; only the optional minor-change changelog reminder. >From 6b321c719023b1c3e512bdb6a833cf6d036e1eaf Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam <[email protected]> Date: Sat, 17 Oct 2026 21:50:17 +0200 Subject: [PATCH] avformat/rtsp: fix leak when replacing dynamic protocol context Repeated a=rtpmap lines for one stream call init_rtp_handler() more than once. A later allocation overwrites dynamic_protocol_context, so only the final allocation remains available to teardown. Close and free an existing context before installing its replacement. Fixes: memleak Signed-off-by: Ratnaker Gautam <[email protected]> --- libavformat/rtsp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index 29f219c366..0fc0140198 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -248,6 +248,12 @@ static void init_rtp_handler(const RTPDynamicProtocolHandler *handler, AVCodecParameters *par = st ? st->codecpar : NULL; if (!handler) return; + if (rtsp_st->dynamic_protocol_context) { + if (rtsp_st->dynamic_handler && rtsp_st->dynamic_handler->close) + rtsp_st->dynamic_handler->close( + rtsp_st->dynamic_protocol_context); + av_freep(&rtsp_st->dynamic_protocol_context); + } if (par) par->codec_id = handler->codec_id; rtsp_st->dynamic_handler = handler; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
