From f3891430fc15cc8a1b7a16916030962e0a4d609c Mon Sep 17 00:00:00 2001 From: Andriy Gelman Date: Thu, 26 Nov 2020 19:37:21 -0500 Subject: [PATCH] avformat/rtspdec: fix potential mem leak in listen mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently a repeating setup request (with the same stream id) will simply overwrite rtp_handle/transport_priv without freeing the resources first. This is fixed by closing the previous setup request. Reviewed-by: Martin Storsjö Signed-off-by: Andriy Gelman --- libavformat/rtspdec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c index be11576913..221f44b20b 100644 --- a/libavformat/rtspdec.c +++ b/libavformat/rtspdec.c @@ -274,6 +274,17 @@ static int rtsp_read_setup(AVFormatContext *s, char* host, char *controlurl) rtsp_st = rt->rtsp_streams[streamid]; localport = rt->rtp_port_min; + /* check if the stream has already been setup */ + if (rtsp_st->transport_priv) { + if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RDT) + ff_rdt_parse_close(rtsp_st->transport_priv); + else if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RTP) + ff_rtp_parse_close(rtsp_st->transport_priv); + rtsp_st->transport_priv = NULL; + } + if (rtsp_st->rtp_handle) + ffurl_closep(&rtsp_st->rtp_handle); + if (request.transports[0].lower_transport == RTSP_LOWER_TRANSPORT_TCP) { rt->lower_transport = RTSP_LOWER_TRANSPORT_TCP; if ((ret = ff_rtsp_open_transport_ctx(s, rtsp_st))) {