[rtmpdump] add alive check for paused stream for rtmpsuck

fcicq fcicq at fcicq.net
Tue Jan 12 17:01:16 CET 2016

Another segmentation fault (null pointer deref) on server->rc.m_channelTimestamp access and lead to a crash.
The video source was suddenly paused before the crash.

I found the only place to free this variable is at  CloseInternal() in librtmp/rtmp.c,
so this null pointer means CloseInternal() was called before the access to server->rc.m_channelTimestamp.
I think the patch attached, which checks RTMP_IsConnected(&server->rc) is the correct fix to handle this issue.

[Switching to Thread 0x7ffff4f24700 (LWP 859)]
doServe (arg=0x7ffff00008c0) at rtmpsuck.c:912
912                       server->rc.m_pauseStamp = server->rc.m_channelTimestamp[server->rc.m_mediaChannel];
(gdb) bt
#0  doServe (arg=0x7ffff00008c0) at rtmpsuck.c:912
#1  0x00007ffff79b86aa in start_thread (arg=0x7ffff4f24700)
    at pthread_create.c:333
#2  0x00007ffff74d0eed in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(gdb) p server->rc.m_mediaChannel
$1 = 4
(gdb) p server->rc.m_channelTimestamp
$2 = (int *) 0x0

diff --git a/rtmpsuck.c b/rtmpsuck.c
index e886179..f5cd313 100644
--- a/rtmpsuck.c
+++ b/rtmpsuck.c
@@ -815,7 +907,7 @@ TFTYPE doServe(void *arg)   // server socket and state (our listening socket)
          if (select(n + 1, &rfds, NULL, NULL, &tv) <= 0)
-              if (server->f_cur && server->rc.m_mediaChannel && !paused)
+              if (server->f_cur && server->rc.m_mediaChannel && !paused && RTMP_IsConnected(&server->rc))
                   server->rc.m_pauseStamp = server->rc.m_channelTimestamp[server->rc.m_mediaChannel];
                   if (RTMP_ToggleStream(&server->rc))

More information about the rtmpdump mailing list