[FFmpeg-devel] [PR] avformat: fix leaks in rtsp_read_command_reply and seq logging (PR #21805)

[Marvin Scholz via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21805 opened by Marvin Scholz (ePirat)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21805
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21805.patch


>From ee555af62a05ad8121d87bceba755f3c1ec6469d Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Thu, 19 Feb 2026 20:27:41 +0100
Subject: [PATCH 1/2] avformat: rtspdec: fix leaks in rtsp_read_command_reply

Reorder to avoid allocation if there is nothing to read and also solve
a memory leak in that case.

Also make sure to free the RTSPMessageHeader, which is not passed
to the caller.
---
 libavformat/rtspdec.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index 1fd50bf9be..c92df06b46 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -674,17 +674,21 @@ static int rtsp_read_command_reply(AVFormatContext *s, enum AVFormatCommandID id
     if (!data_out)
         return AVERROR(EINVAL);
 
-    AVRTSPResponse *res = av_malloc(sizeof(*res));
-    if (!res)
-        return AVERROR(ENOMEM);
-
+    unsigned char *body;
     RTSPMessageHeader *reply;
-    int ret = ff_rtsp_read_reply_async_stored(s, &reply, &res->body);
+    int ret = ff_rtsp_read_reply_async_stored(s, &reply, &body);
     if (ret < 0)
         return ret;
 
+    AVRTSPResponse *res = av_malloc(sizeof(*res));
+    if (!res) {
+        av_free(body);
+        return AVERROR(ENOMEM);
+    }
+
     res->status_code = reply->status_code;
     res->body_len = reply->content_length;
+    res->body = body;
 
     res->reason = av_strdup(reply->reason);
     if (!res->reason) {
@@ -694,6 +698,7 @@ static int rtsp_read_command_reply(AVFormatContext *s, enum AVFormatCommandID id
         return AVERROR(ENOMEM);
     }
 
+    av_free(reply);
     *data_out = res;
     return 0;
 }
-- 
2.52.0


>From 80ac2fca2beb31d5e3cbc025d2a2474e2f66cbd3 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Thu, 19 Feb 2026 20:28:19 +0100
Subject: [PATCH 2/2] avformat: rtsp: fix logging of reply sequence number

---
 libavformat/rtsp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index 1362cb683b..822780087d 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -1415,7 +1415,7 @@ int ff_rtsp_read_reply(AVFormatContext *s, RTSPMessageHeader *reply,
             memcpy(rt->stored_msg.header, &header, sizeof(header));
         } else {
             av_log(s, AV_LOG_WARNING, "Unexpected reply with seq %d, expected %d\n",
-                rt->stored_msg.header->seq, rt->stored_msg.expected_seq);
+                header.seq, rt->stored_msg.expected_seq);
             av_freep(&rt->stored_msg.body);
         }
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org