From eric.beuque at jet1oeil.com  Wed May  7 22:20:33 2025
From: eric.beuque at jet1oeil.com (Eric Beuque)
Date: Thu, 8 May 2025 07:20:33 +0200
Subject: [Live-devel] Possible crash on BufferedPacket deallocation
Message-ID: <CAEQfcgRYKdLWy5RRnNobOOuQr+Gt_vjMWTekx_i9byvcm=W=qg@mail.gmail.com>

Hello,

I found a crash that can be caused in some circonstance.

I use a RTSPClient reading a video stream from Dahua camera.
I selected a too small MediaSink buffer to get frame, so i stopped the
stream when receiving truncated bytes.
But during 30 seconds (delay for my activity check handler), the RTSP
stream continues to read packets from the camera and create
H265BufferedPacket.
After 30 seconds livemedia shutdown the stream and released the packet.

But due to the recursive deallocation of BufferedPacket, on Windows I
received a crash on the stack size after trying to delete more than 5700
packets.

I can probably fix thing on my side but replacing :

BufferedPacket::~BufferedPacket() {
delete fNextPacket;
delete[] fBuf;
}

by :

BufferedPacket::~BufferedPacket() {
BufferedPacket *nextPacket = fNextPacket;
while (nextPacket != nullptr) {
BufferedPacket *tmpPacket = nextPacket;
nextPacket = tmpPacket->fNextPacket;
tmpPacket->fNextPacket = nullptr;
delete tmpPacket;
}
delete[] fBuf;
}

Fix the crash for me.


Eric BEUQUE - Software architect / developer

T. 03 81 50 51 50 | www.jet1oeil.com

5 rue Victor Consid?rant, Parc d?Activit?s de l?Echange 25770 Chemaudin et
Vaux
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20250508/533b414d/attachment.htm>

From finlayson at live555.com  Wed May  7 22:43:16 2025
From: finlayson at live555.com (Ross Finlayson)
Date: Wed, 7 May 2025 22:43:16 -0700
Subject: [Live-devel] Possible crash on BufferedPacket deallocation
In-Reply-To: <CAEQfcgRYKdLWy5RRnNobOOuQr+Gt_vjMWTekx_i9byvcm=W=qg@mail.gmail.com>
References: <CAEQfcgRYKdLWy5RRnNobOOuQr+Gt_vjMWTekx_i9byvcm=W=qg@mail.gmail.com>
Message-ID: <4F068088-4BF9-461C-9487-A11FFCA11D59@live555.com>

Eric,

Thanks for the report.

I suspect that most other peoples' compiler is smart enough to replace the tail recursion here with iteration, but just in case, I?ve released a new version (2025.05.08) of the code that does this explicitly, as you suggested.


Ross Finlayson
Live Networks, Inc.
http://www.live555.com/



From eric.beuque at jet1oeil.com  Thu May  8 00:28:18 2025
From: eric.beuque at jet1oeil.com (Eric Beuque)
Date: Thu, 8 May 2025 09:28:18 +0200
Subject: [Live-devel] Possible crash on BufferedPacket deallocation
In-Reply-To: <4F068088-4BF9-461C-9487-A11FFCA11D59@live555.com>
References: <CAEQfcgRYKdLWy5RRnNobOOuQr+Gt_vjMWTekx_i9byvcm=W=qg@mail.gmail.com>
 <4F068088-4BF9-461C-9487-A11FFCA11D59@live555.com>
Message-ID: <CAEQfcgQUYGRphCtTO=mGD8bU6gDpmq0hLvZ9zG0Ruz0M+iDTWg@mail.gmail.com>

Thank you for the fix integration

Eric BEUQUE - Software architect / developer

T. 03 81 50 51 50 | www.jet1oeil.com

5 rue Victor Consid?rant, Parc d?Activit?s de l?Echange 25770 Chemaudin et
Vaux



Le jeu. 8 mai 2025 ? 07:46, Ross Finlayson <finlayson at live555.com> a ?crit :

> Eric,
>
> Thanks for the report.
>
> I suspect that most other peoples' compiler is smart enough to replace the
> tail recursion here with iteration, but just in case, I?ve released a new
> version (2025.05.08) of the code that does this explicitly, as you
> suggested.
>
>
> Ross Finlayson
> Live Networks, Inc.
> http://www.live555.com/
>
>
> _______________________________________________
> live-devel mailing list
> live-devel at lists.live555.com
> http://lists.live555.com/mailman/listinfo/live-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20250508/67fdc0fc/attachment.htm>