Fix an use-after-free bug

Originally committed as revision 8759 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/ffserver.c b/ffserver.c
index 5297404..b5cd93a 100644 (file)
--- a/ffserver.c
+++ b/ffserver.c
@@ -3062,6 +3062,7 @@ static void rtsp_cmd_pause(HTTPContext *c, const char *url, RTSPHeader *h)
 static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
 {
     HTTPContext *rtp_c;
+    char session_id[32];
 
     rtp_c = find_rtp_session_with_url(url, h->session_id);
     if (!rtp_c) {
@@ -3069,13 +3070,15 @@ static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
         return;
     }
 
+    pstrcpy(session_id, sizeof(session_id), rtp_c->session_id);
+
     /* abort the session */
     close_connection(rtp_c);
 
     /* now everything is OK, so we can send the connection parameters */
     rtsp_reply_header(c, RTSP_STATUS_OK);
     /* session ID */
-    url_fprintf(c->pb, "Session: %s\r\n", rtp_c->session_id);
+    url_fprintf(c->pb, "Session: %s\r\n", session_id);
     url_fprintf(c->pb, "\r\n");
 }