[FFmpeg-devel] [PATCH] avformat/rtmpproto: fix rmtp packet leak in gen_connect()

[Zhao Zhili]

> On Jun 14, 2025, at 16:33, Lidong Yan <yldhome2d2-at-gmail.com at ffmpeg.org> wrote:
> 
> In libavformat/rtmpproto.c:gen_connect(), if check on string length
> or check on codec fourcc failed, ff_rtmp_packet_create() allocated
> data in pkt would leak. Add ff_rtmp_packet_destory before return error
> code.
> 
> Signed-off-by: Lidong Yan <502024330056 at smail.nju.edu.cn>
> 
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> 
> mDMEaEpkmRYJKwYBBAHaRw8BAQdAGwGqH/Dwod+i6kR0/Rhn5GanJ7wK8mM9tWP/
> W2qu8Ti0HTUwMjAyNDMzMDA1NkBzbWFpbC5uanUuZWR1LmNuiJkEExYKAEEWIQQC
> zskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIbAwUJBaOagAULCQgHAgIiAgYVCgkI
> CwIEFgIDAQIeBwIXgAAKCRCZR31bPD+6o8wHAQCLomsA4XfTd8IdG983gGULUJe/
> 0432buy4nX7AsAc87QEA+/QIsWTR6XLJaLa1sLSQCsZkb86U3c17JzG9oivL8gW4
> OARoSmSZEgorBgEEAZdVAQUBAQdAfYrEAWd+6bOXkKvHpFmMvKzxAtlhm6ZQKdAq
> +MlJ7wQDAQgHiHgEGBYKACAWIQQCzskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIb
> DAAKCRCZR31bPD+6ozWxAQC9OFisWrP/hHXUfj8AnC39r5pf5fEBz7lHvFgWNk2b
> XwD7Bl6kvIIW7ReqtgXvcl7u78vEo+e9YeTGTlmAogjpeQk=
> =rP+W
> -----END PGP PUBLIC KEY BLOCK-----
> 
> ---
> libavformat/rtmpproto.c | 2 ++
> 1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
> index 846376e668..dd850f72ed 100644
> --- a/libavformat/rtmpproto.c
> +++ b/libavformat/rtmpproto.c
> @@ -347,6 +347,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
>         if ((fourcc_str_len + 1) % 5 != 0) {
>             av_log(s, AV_LOG_ERROR, "Malformed rtmp_enhanched_codecs, "
>                    "should be of the form hvc1[,av01][,vp09][,...]\n");
> +            ff_rtmp_packet_destroy(&pkt);
>             return AVERROR(EINVAL);
>         }
> 
> @@ -370,6 +371,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
>                     ff_amf_write_string(&p, fourcc);
>             } else {
>                     av_log(s, AV_LOG_ERROR, "Unsupported codec fourcc, %.*s\n", 4, fourcc_data);
> +                    ff_rtmp_packet_destroy(&pkt);
>                     return AVERROR_PATCHWELCOME;
>             }

LGTM.

> 
> -- 
> 2.50.0.rc0.47.g9cc88feafa.dirty
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".