From b0b2faa70995caf710bf49c7c6eb6dc502a67672 Mon Sep 17 00:00:00 2001 From: Luca Abeni Date: Thu, 19 Apr 2007 13:55:06 +0000 Subject: [PATCH] Fix an use-after-free bug Originally committed as revision 8759 to svn://svn.ffmpeg.org/ffmpeg/trunk --- ffserver.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ffserver.c b/ffserver.c index 529740466e..b5cd93a4a6 100644 --- a/ffserver.c +++ b/ffserver.c @@ -3062,6 +3062,7 @@ static void rtsp_cmd_pause(HTTPContext *c, const char *url, RTSPHeader *h) static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h) { HTTPContext *rtp_c; + char session_id[32]; rtp_c = find_rtp_session_with_url(url, h->session_id); if (!rtp_c) { @@ -3069,13 +3070,15 @@ static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h) return; } + pstrcpy(session_id, sizeof(session_id), rtp_c->session_id); + /* abort the session */ close_connection(rtp_c); /* now everything is OK, so we can send the connection parameters */ rtsp_reply_header(c, RTSP_STATUS_OK); /* session ID */ - url_fprintf(c->pb, "Session: %s\r\n", rtp_c->session_id); + url_fprintf(c->pb, "Session: %s\r\n", session_id); url_fprintf(c->pb, "\r\n"); }