[FFmpeg-cvslog] avformat/rtmpproto: fix rmtp packet leak in gen_connect()

[Lidong Yan]

ffmpeg | branch: master | Lidong Yan <yldhome2d2 at gmail.com> | Sat Jun 14 16:33:50 2025 +0800| [b65fece0aa93d4c2898a3ce1e3de37ccbc87ec5e] | committer: Michael Niedermayer

avformat/rtmpproto: fix rmtp packet leak in gen_connect()

In libavformat/rtmpproto.c:gen_connect(), if check on string length
or check on codec fourcc failed, ff_rtmp_packet_create() allocated
data in pkt would leak. Add ff_rtmp_packet_destory before return error
code.

Signed-off-by: Lidong Yan <502024330056 at smail.nju.edu.cn>
Reviewed-by: Zhao Zhili <quinkblack at foxmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b65fece0aa93d4c2898a3ce1e3de37ccbc87ec5e
---

 libavformat/rtmpproto.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 846376e668..dd850f72ed 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -347,6 +347,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
         if ((fourcc_str_len + 1) % 5 != 0) {
             av_log(s, AV_LOG_ERROR, "Malformed rtmp_enhanched_codecs, "
                    "should be of the form hvc1[,av01][,vp09][,...]\n");
+            ff_rtmp_packet_destroy(&pkt);
             return AVERROR(EINVAL);
         }
 
@@ -370,6 +371,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
                     ff_amf_write_string(&p, fourcc);
             } else {
                     av_log(s, AV_LOG_ERROR, "Unsupported codec fourcc, %.*s\n", 4, fourcc_data);
+                    ff_rtmp_packet_destroy(&pkt);
                     return AVERROR_PATCHWELCOME;
             }