[Live-devel] Nested TaskScheduler::doEventLoop causes bug with deleting RTSPClientSession

[Vadim Kosarev]

Hello all!

I'm developing RTSP server based on liveMedia library.
I have started separate thread for liveMedia in my class RMXFRTSPThread and 
call doEventLoop().
Then I start VLC and connect to RTSP stream. This stream must take media 
data from my live H264 video source
(I have written child class of FramedSource and child class of 
OnDemandServerMediaSubsession to do it).
The live video source take about 10 sec to initialize (in separate thread). 
My child of FramedSource triggers
event in task scheduler to signal live stream ready.
Then H264VideoRTPSink must get SPS and PPS from this live stream to compose 
SDP lines.
To wait for live source and SDP lines my class 
H264VideoDeviceServerMediaSubsession (child of 
OnDemandServerMediaSubsession)
calls doEventLoop() exactly as H264VideoFileServerMediaSubsession library 
class.
But RTSP client (VLC) closes TCP connection to server before all 
initializations are complete.

This stream initialization process causes exception - library code accesses 
RTSPClientSession object which has already been deleted.
This is a stack when the RTSPClientSession object is deleted:

1. RTSPServer::RTSPClientSession::handleRequestBytes
2. RTSPServer::RTSPClientSession::incomingRequestHandler1
3. RTSPServer::RTSPClientSession::incomingRequestHandler
4. BasicTaskScheduler::SingleStep
5. RMXFRTSPTaskScheduler::SingleStep
6. BasicTaskScheduler0::doEventLoop
7. H264VideoDeviceServerMediaSubsession::getAuxSDPLine
8. OnDemandServerMediaSubsession::setSDPLinesFromRTPSink
9. OnDemandServerMediaSubsession::sdpLines
10. ServerMediaSession::generateSDPDescription
11. RTSPServer::RTSPClientSession::handleCmd_DESCRIBE
12. RTSPServer::RTSPClientSession::handleRequestBytes
13. RTSPServer::RTSPClientSession::incomingRequestHandler1
14. RTSPServer::RTSPClientSession::incomingRequestHandler
15. BasicTaskScheduler::SingleStep
16. RMXFRTSPTaskScheduler::SingleStep
17. BasicTaskScheduler0::doEventLoop
18. RMXFRTSPThread::ThreadProc

Some explanations of names in stack:
RMXFRTSPThread::ThreadProc - my class with single thread for liveMedia lib
RMXFRTSPTaskScheduler - my child class of BasicTaskScheduler
H264VideoDeviceServerMediaSubsession - my child class of 
OnDemandServerMediaSubsession

What causes this exception? There are explanation:
RTSPServer::RTSPClientSession::handleRequestBytes on top of stack deletes 
current RTSPClientSession object because incoming client TCP connection is 
closed (newBytesRead argument is 0 - see first 'if' on top of 
handleRequestBytes method). But the same RTSPClientSession object is 
handling DESCRIBE client command below in stack (lines 11-14; it waits for 
SDP) and when the live video device SDP lines is ready, library code 
accesses already deleted RTSPClientSession object.

I think there are error in choosing RTSPClientSession deleting point 
(because of possible nested doEventLoop calls).

Best regards,
Vadim Kosarev