external/srs
1
0
Fork 0
mirror of https://github.com/ossrs/srs.git synced 2025-03-09 15:49:59 +00:00
Code Issues Releases Wiki Activity

Fix double free bug for RTP

Browse source
This commit is contained in:
winlin 2020-04-19 13:16:48 +08:00
parent 6a4e043349
commit 32879eaf47
3 changed files with 5 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
trunk/src/app/srs_app_rtc_conn.cpp
View file

@ -1212,6 +1212,10 @@ srs_error_t SrsRtcSenderThread::packet_nalus(SrsSharedPtrMessage* msg, SrsRtcPac
packet->payload = raw; packet->payload = raw;
} else { } else {
// We must free it, should never use RTP packets to free it,
// because more than one RTP packet will refer to it.
SrsAutoFree(SrsRtpRawNALUs, raw);
// Package NALUs in FU-A RTP packets. // Package NALUs in FU-A RTP packets.
int fu_payload_size = kRtpMaxPayloadSize; int fu_payload_size = kRtpMaxPayloadSize;
@ -1229,7 +1233,6 @@ srs_error_t SrsRtcSenderThread::packet_nalus(SrsSharedPtrMessage* msg, SrsRtcPac
srs_freep(raw); srs_freep(raw);
return srs_error_new(ERROR_RTC_RTP_MUXER, "cache empty"); return srs_error_new(ERROR_RTC_RTP_MUXER, "cache empty");
} }
packet->extra_payload = raw;
packet->rtp_header.set_timestamp(msg->timestamp * 90); packet->rtp_header.set_timestamp(msg->timestamp * 90);
packet->rtp_header.set_sequence(video_sequence++); packet->rtp_header.set_sequence(video_sequence++);

5
trunk/src/kernel/srs_kernel_rtp.cpp
View file

@ -151,7 +151,6 @@ size_t SrsRtpHeader::header_size()
SrsRtpPacket2::SrsRtpPacket2() SrsRtpPacket2::SrsRtpPacket2()
{ {
payload = NULL; payload = NULL;
extra_payload = NULL;
padding = 0; padding = 0;
cache_raw = new SrsRtpRawPayload(); cache_raw = new SrsRtpRawPayload();
@ -167,7 +166,6 @@ SrsRtpPacket2::~SrsRtpPacket2()
} }
srs_freep(payload); srs_freep(payload);
srs_freep(extra_payload);
srs_freep(cache_raw); srs_freep(cache_raw);
srs_freep(cache_fua); srs_freep(cache_fua);
} }
@ -195,7 +193,6 @@ void SrsRtpPacket2::reset()
rtp_header.reset(); rtp_header.reset();
padding = 0; padding = 0;
cache_payload = 0; cache_payload = 0;
srs_freep(extra_payload);
// We may use the cache as payload. // We may use the cache as payload.
if (payload == cache_raw || payload == cache_fua) { if (payload == cache_raw || payload == cache_fua) {
@ -330,7 +327,7 @@ srs_error_t SrsRtpRawNALUs::read_samples(vector<SrsSample*>& samples, int packet
int left = packet_size; int left = packet_size;
int nn_nalus = (int)nalus.size(); int nn_nalus = (int)nalus.size();
for (int i = 0; i < nn_nalus; i++) { for (int i = 0; left > 0 && i < nn_nalus; i++) {
SrsSample* p = nalus[i]; SrsSample* p = nalus[i];
// Ignore previous consumed samples. // Ignore previous consumed samples.

5
trunk/src/kernel/srs_kernel_rtp.hpp
View file

@ -84,11 +84,6 @@ public:
SrsRtpHeader rtp_header; SrsRtpHeader rtp_header;
ISrsEncoder* payload; ISrsEncoder* payload;
int padding; int padding;
public:
// User can set an extra payload, we will free it.
// For example, when reassemble NALUs by SrsRtpRawNALUs, we can set the extra payload to
// SrsRtpRawNALUs, then we can use SrsRtpFUAPayload which never free samples.
ISrsEncoder* extra_payload;
private: private:
SrsRtpRawPayload* cache_raw; SrsRtpRawPayload* cache_raw;
SrsRtpFUAPayload2* cache_fua; SrsRtpFUAPayload2* cache_fua;