[SCM] libav/experimental: Fix an use-after-free bug
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Jun 30 15:59:01 UTC 2013
The following commit has been merged in the experimental branch:
commit b0b2faa70995caf710bf49c7c6eb6dc502a67672
Author: Luca Abeni <lucabe72 at email.it>
Date: Thu Apr 19 13:55:06 2007 +0000
Fix an use-after-free bug
Originally committed as revision 8759 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/ffserver.c b/ffserver.c
index 5297404..b5cd93a 100644
--- a/ffserver.c
+++ b/ffserver.c
@@ -3062,6 +3062,7 @@ static void rtsp_cmd_pause(HTTPContext *c, const char *url, RTSPHeader *h)
static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
{
HTTPContext *rtp_c;
+ char session_id[32];
rtp_c = find_rtp_session_with_url(url, h->session_id);
if (!rtp_c) {
@@ -3069,13 +3070,15 @@ static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
return;
}
+ pstrcpy(session_id, sizeof(session_id), rtp_c->session_id);
+
/* abort the session */
close_connection(rtp_c);
/* now everything is OK, so we can send the connection parameters */
rtsp_reply_header(c, RTSP_STATUS_OK);
/* session ID */
- url_fprintf(c->pb, "Session: %s\r\n", rtp_c->session_id);
+ url_fprintf(c->pb, "Session: %s\r\n", session_id);
url_fprintf(c->pb, "\r\n");
}
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list