From: Luca Abeni <lucabe72@email.it>
Date: Thu, 19 Apr 2007 13:55:06 +0000 (+0000)
Subject: Fix an use-after-free bug
X-Git-Tag: v0.5~9270
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b0b2faa70995caf710bf49c7c6eb6dc502a67672;p=platform%2Fupstream%2Flibav.git

Fix an use-after-free bug

Originally committed as revision 8759 to svn://svn.ffmpeg.org/ffmpeg/trunk
---

diff --git a/ffserver.c b/ffserver.c
index 5297404..b5cd93a 100644
--- a/ffserver.c
+++ b/ffserver.c
@@ -3062,6 +3062,7 @@ static void rtsp_cmd_pause(HTTPContext *c, const char *url, RTSPHeader *h)
 static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
 {
     HTTPContext *rtp_c;
+    char session_id[32];
 
     rtp_c = find_rtp_session_with_url(url, h->session_id);
     if (!rtp_c) {
@@ -3069,13 +3070,15 @@ static void rtsp_cmd_teardown(HTTPContext *c, const char *url, RTSPHeader *h)
         return;
     }
 
+    pstrcpy(session_id, sizeof(session_id), rtp_c->session_id);
+
     /* abort the session */
     close_connection(rtp_c);
 
     /* now everything is OK, so we can send the connection parameters */
     rtsp_reply_header(c, RTSP_STATUS_OK);
     /* session ID */
-    url_fprintf(c->pb, "Session: %s\r\n", rtp_c->session_id);
+    url_fprintf(c->pb, "Session: %s\r\n", session_id);
     url_fprintf(c->pb, "\r\n");
 }