From 271c869cc3285dac2b6f2663a87c70bf3ba2b04f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Wed, 25 May 2011 19:08:29 +0300
Subject: [PATCH] rtmp: Don't try to do av_malloc(0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some received packets can have size 0. The return value from
av_malloc(0) may be NULL, which is ok if the size was 0. On
OS X, however, the returned pointer is non-null but leads to
crashes when trying to free it.

Signed-off-by: Martin Storsjö <martin@martin.st>
---
 libavformat/rtmppkt.c   | 2 ++
 libavformat/rtmpproto.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/rtmppkt.c b/libavformat/rtmppkt.c
index 63b0628799..93790eb525 100644
--- a/libavformat/rtmppkt.c
+++ b/libavformat/rtmppkt.c
@@ -233,9 +233,11 @@ int ff_rtmp_packet_write(URLContext *h, RTMPPacket *pkt,
 int ff_rtmp_packet_create(RTMPPacket *pkt, int channel_id, RTMPPacketType type,
                           int timestamp, int size)
 {
+    if (size) {
     pkt->data = av_malloc(size);
     if (!pkt->data)
         return AVERROR(ENOMEM);
+    }
     pkt->data_size  = size;
     pkt->channel_id = channel_id;
     pkt->type       = type;
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 70e4b142d6..f499bd3b71 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -683,7 +683,7 @@ static int get_packet(URLContext *s, int for_header)
         return AVERROR_EOF;
 
     for (;;) {
-        RTMPPacket rpkt;
+        RTMPPacket rpkt = { 0 };
         if ((ret = ff_rtmp_packet_read(rt->stream, &rpkt,
                                        rt->chunk_size, rt->prev_pkt[0])) <= 0) {
             if (ret == 0) {