[FFmpeg-devel] [PATCH 2/2] avformat/rtspdec: fix potential mem leak in listen mode

[Andriy Gelman]

From: Andriy Gelman <andriy.gelman at gmail.com>

Currently a repeating setup request (with the same stream id) will
simply overwrite rtp_handle/transport_priv without freeing the
resources first. This is fixed by closing the previous setup request.

Signed-off-by: Andriy Gelman <andriy.gelman at gmail.com>
---
 libavformat/rtspdec.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index be11576913..4352a94376 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -274,6 +274,16 @@ static int rtsp_read_setup(AVFormatContext *s, char* host, char *controlurl)
     rtsp_st   = rt->rtsp_streams[streamid];
     localport = rt->rtp_port_min;
 
+    /* check if the stream has already been setup */
+    if (rtsp_st->rtp_handle || rtsp_st->transport_priv) {
+        if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RDT)
+            ff_rdt_parse_close(rtsp_st->transport_priv);
+        else if (CONFIG_RTPDEC && rt->transport == RTSP_TRANSPORT_RTP)
+            ff_rtp_parse_close(rtsp_st->transport_priv);
+        rtsp_st->transport_priv = NULL;
+        ffurl_closep(&rtsp_st->rtp_handle);
+    }
+
     if (request.transports[0].lower_transport == RTSP_LOWER_TRANSPORT_TCP) {
         rt->lower_transport = RTSP_LOWER_TRANSPORT_TCP;
         if ((ret = ff_rtsp_open_transport_ctx(s, rtsp_st))) {
-- 
2.28.0