From 924e24a0de0e7bd72dd43b974130628b23de05c6 Mon Sep 17 00:00:00 2001 From: William King Date: Wed, 8 May 2013 16:31:27 -0700 Subject: [PATCH] FS-5395: --resolve Resolve another mod_rtmp crash where oh specific hangup scenarios there would be a free of variable that wasn't ever malloced --- src/mod/endpoints/mod_rtmp/mod_rtmp.c | 1 + src/mod/endpoints/mod_rtmp/rtmp_tcp.c | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mod/endpoints/mod_rtmp/mod_rtmp.c b/src/mod/endpoints/mod_rtmp/mod_rtmp.c index 8311c6bcb0..79d5a7626a 100644 --- a/src/mod/endpoints/mod_rtmp/mod_rtmp.c +++ b/src/mod/endpoints/mod_rtmp/mod_rtmp.c @@ -767,6 +767,7 @@ switch_status_t rtmp_session_request(rtmp_profile_t *profile, rtmp_session_t **n (*newsession)->in_chunksize = (*newsession)->out_chunksize = RTMP_DEFAULT_CHUNKSIZE; (*newsession)->recv_ack_window = RTMP_DEFAULT_ACK_WINDOW; (*newsession)->next_streamid = 1; + (*newsession)->io_private = NULL; switch_uuid_get(&uuid); switch_uuid_format((*newsession)->uuid, &uuid); diff --git a/src/mod/endpoints/mod_rtmp/rtmp_tcp.c b/src/mod/endpoints/mod_rtmp/rtmp_tcp.c index 1e5fd118ad..62caf23185 100644 --- a/src/mod/endpoints/mod_rtmp/rtmp_tcp.c +++ b/src/mod/endpoints/mod_rtmp/rtmp_tcp.c @@ -183,8 +183,10 @@ static switch_status_t rtmp_tcp_close(rtmp_session_t *rsession) switch_buffer_destroy(&(io_pvt->sendq)); } - free(rsession->io_private); - rsession->io_private = NULL; + if ( rsession->io_private ) { + free(rsession->io_private); + rsession->io_private = NULL; + } return SWITCH_STATUS_SUCCESS; }