<div dir="ltr">Howard,<div><br></div><div>I appreciate the response. With that in mind and looking at the code a little more, it seems like the two RTMP_IsConnected calls for each of the streams and setting the FDs for the select would trigger the check below that causes the crash provided server->rs is still valid while server->rc is in a closed state. I don't see anything in the code below the RMTP_IsConnected calls that would verify that server->rc is even open at the time of the select since select is called as long as one of the two are open. It looks like the problem is the assumption that server->rc is even still valid at the time the select goes through. </div><div><br></div><div>Anyway, I'm going to take you up on your suggestion and test with it since it seems preferable to follow the standard instead of using a one-off. How would this generally make it into the git repository? Documentation is a bit lacking in regards to that.<br></div><div><br></div><div>Thanks again</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 27, 2014 at 10:16 AM, Howard Chu <span dir="ltr"><<a href="mailto:hyc@highlandsun.com" target="_blank">hyc@highlandsun.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Matt Breedlove wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hey guys,<br>
<br>
I've run into a case that happens while running rtmpsuck where a null<br>
dereference will eventually occur. I'm running a Windows build currently but<br>
this was present in the Linux build also from the latest version on back.<br>
<br>
<br>
FAULTING_IP:<br>
image00400000+2eab<br>
00402eab 8b0482 mov eax,dword ptr [edx+eax*4]<br>
<br>
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)<br>
ExceptionAddress: 00402eab (image00400000+0x00002eab)<br>
ExceptionCode: c0000005 (Access violation)<br>
ExceptionFlags: 00000000<br>
NumberParameters: 2<br>
Parameter[0]: 00000000<br>
Parameter[1]: 00000018<br>
Attempt to read from address 00000018<br>
<br>
CONTEXT: 00000000 -- (.cxr 0x0;r)<br>
eax=00000006 ebx=0b835be0 ecx=0dce1298 edx=00000000 esi=0e60fdb8 edi=0b835bf0<br>
eip=00402eab esp=0e60fd3c ebp=0e60ff14 iopl=0 nv up ei pl zr na pe nc<br>
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246<br>
image00400000+0x2eab:<br>
00402eab 8b0482 mov eax,dword ptr [edx+eax*4]<br>
ds:002b:00000018=????????<br>
<br>
<br>
rtmpsuck.c on line 818:<br>
<br>
server->rc.m_pauseStamp =<br>
server->rc.m_channelTimestamp[<u></u>server->rc.m_mediaChannel];<br>
<br>
compiles to:<br>
<br>
movecx, [ebx+8418h]<br>
testecx, ecx<br>
jzshort loc_402EE2# jz server->f_cur<br></div></div>
moveax, [ebx+4224h]# server->rc.m_mediaChannel => eax (6)<span class=""><br>
testeax, eax<br>
jzshort loc_402EE2# jz server->rc.m_mediaChannel<br>
movedx, [ebp+var_1A4]<br>
testedx, edx<br>
jnzshort loc_402EE2# jnz paused<br></span>
movedx, [ebx+425Ch]# server->rc.m_channelTimestamp => edx (0)<br>
moveax, [edx+eax*4]# edx(0)+eax(6)*4 == 0x18<br>
mov[ebx+422Ch], eax<br>
moveax, [ebp+var_19C]<span class=""><br>
mov[esp], eax<br>
call_RTMP_ToggleStream<br></span>
testeax, eax<span class=""><br>
<br>
<br>
The following patch seems to at least prevent the process from crashing but I<br>
was hoping to get some input in case this might just be a symptom of another<br>
problem. I'm not familiar enough with the protocol or codebase. Any thoughts?<br>
<br>
rtmpsuck.c:<br>
<br>
818c818<br>
< if (server->f_cur && server->rc.m_mediaChannel &&<br>
server->rc.m_channelTimestamp && !paused)<br>
---<br>
> if (server->f_cur && server->rc.m_mediaChannel && !paused)<br>
<br>
<br>
Regards,<br>
Matt Breedlove<br>
</span></blockquote>
<br>
The only way for m_channelTimestamp to be NULL is if RTMP_Close was called on that handle. Your patch will work fine, though it may not be the most obvious check. Typically you'd check for m_stream_id >= 0 to see if the handle is still alive.<br>
<br>
______________________________<u></u>_________________<br>
rtmpdump mailing list<br>
<a href="mailto:rtmpdump@mplayerhq.hu" target="_blank">rtmpdump@mplayerhq.hu</a><br>
<a href="https://lists.mplayerhq.hu/mailman/listinfo/rtmpdump" target="_blank">https://lists.mplayerhq.hu/<u></u>mailman/listinfo/rtmpdump</a><br>
</blockquote></div><br></div>