From 692fd5635f9fdaa493249f0488d890688b45601d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Mon, 9 Mar 2015 23:14:19 +0200 Subject: [PATCH] rtpenc_mpegts: Set chain->rtp_ctx only after avformat_write_header succeeded MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit By making sure we at each time only have one pointer set, either a local variable or one in the context, we avoid potential double frees in the cleanup routines. If chain->rtp_ctx is set, it is closed by calling avformat_write_trailer, but that shouldn't be called unless avformat_write_header succeeded. This issue was pointed out by Andreas Cadhalpun. Signed-off-by: Martin Storsjö (cherry picked from commit cf402d6fa88acd647cdff993429583bec8a34fdc) Signed-off-by: Andreas Cadhalpun --- libavformat/rtpenc_mpegts.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/rtpenc_mpegts.c b/libavformat/rtpenc_mpegts.c index b49ee818fb..db1680e069 100644 --- a/libavformat/rtpenc_mpegts.c +++ b/libavformat/rtpenc_mpegts.c @@ -88,11 +88,10 @@ static int rtp_mpegts_write_header(AVFormatContext *s) st->time_base.num = 1; st->time_base.den = 90000; st->codec->codec_id = AV_CODEC_ID_MPEG2TS; - chain->rtp_ctx = rtp_ctx; rtp_ctx->pb = s->pb; if ((ret = avformat_write_header(rtp_ctx, NULL)) < 0) goto fail; - rtp_ctx = NULL; + chain->rtp_ctx = rtp_ctx; return 0;