[Live-devel] problem processing RTSP TEARDOWN

[PROMONET Michel]

            Hi Ross,

Recently appears a case of use of memory that is no more allocated.

It is possible to reproduce this using live555MediaServer and openRTSP -d 5 <one of the RTSP URL served by live555MediaServer>

The valgrind lokks like :
==9860== Invalid read of size 1
==9860==    at 0x4AD5B5: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:1096)
==9860==    by 0x4AC3C8: RTSPServer::RTSPClientConnection::incomingRequestHandler1() (RTSPServer.cpp:787)
==9860==    by 0x4AC344: RTSPServer::RTSPClientConnection::incomingRequestHandler(void*, int) (RTSPServer.cpp:780)
==9860==    by 0x504E0A: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:159)
==9860==    by 0x50369B: BasicTaskScheduler0::doEventLoop(char*) (BasicTaskScheduler0.cpp:92)
==9860==    by 0x46212B: main (live555MediaServer.cpp:88)
==9860==  Address 0x5bed261 is 33 bytes inside a block of size 64 free'd
==9860==    at 0x4C26DCF: operator delete(void*) (vg_replace_malloc.c:387)
==9860==    by 0x4AE791: RTSPServer::RTSPClientSession::~RTSPClientSession() (RTSPServer.cpp:1380)
==9860==    by 0x4B00C8: RTSPServer::RTSPClientSession::handleCmd_TEARDOWN(RTSPServer::RTSPClientConnection*, ServerMediaSubsession*) (RTSPServer.cpp:1817)
==9860==    by 0x4AFE50: RTSPServer::RTSPClientSession::handleCmd_withinSession(RTSPServer::RTSPClientConnection*, char const*, char const*, char const*, char const*) (RTSPServer.cpp:1780)
==9860==    by 0x4AD127: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:1012)
==9860==    by 0x4AC3C8: RTSPServer::RTSPClientConnection::incomingRequestHandler1() (RTSPServer.cpp:787)
==9860==    by 0x4AC344: RTSPServer::RTSPClientConnection::incomingRequestHandler(void*, int) (RTSPServer.cpp:780)
==9860==    by 0x504E0A: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:159)
==9860==    by 0x50369B: BasicTaskScheduler0::doEventLoop(char*) (BasicTaskScheduler0.cpp:92)
==9860==    by 0x46212B: main (live555MediaServer.cpp:88)
==986


The code that cause the problem trig an internal PLAY during SETUP processing, so perhaps clientSession could be set to NULL after calling handleCmd_withinSession (RTSPServer:1012).

Thanks for your support,

            Michel.

[@@ THALES GROUP INTERNAL @@]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20140116/8fa442fe/attachment.html>