The function avformat_new_stream() returns a NULL pointer on failure.
However, in function rtp_mpegts_write_header(), its return value is not
validated before it is dereferenced. Check the return value against NULL
to avoid potential NULL dereference.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Currently, AVStream contains an embedded AVCodecContext instance, which
is used by demuxers to export stream parameters to the caller and by
muxers to receive stream parameters from the caller. It is also used
internally as the codec context that is passed to parsers.
In addition, it is also widely used by the callers as the decoding (when
demuxer) or encoding (when muxing) context, though this has been
officially discouraged since Libav 11.
There are multiple important problems with this approach:
- the fields in AVCodecContext are in general one of
* stream parameters
* codec options
* codec state
However, it's not clear which ones are which. It is consequently
unclear which fields are a demuxer allowed to set or a muxer allowed to
read. This leads to erratic behaviour depending on whether decoding or
encoding is being performed or not (and whether it uses the AVStream
embedded codec context).
- various synchronization issues arising from the fact that the same
context is used by several different APIs (muxers/demuxers,
parsers, bitstream filters and encoders/decoders) simultaneously, with
there being no clear rules for who can modify what and the different
processes being typically delayed with respect to each other.
- avformat_find_stream_info() making it necessary to support opening
and closing a single codec context multiple times, thus
complicating the semantics of freeing various allocated objects in the
codec context.
Those problems are resolved by replacing the AVStream embedded codec
context with a newly added AVCodecParameters instance, which stores only
the stream parameters exported by the demuxers or read by the muxers.
* commit 'cf402d6fa88acd647cdff993429583bec8a34fdc':
rtpenc_mpegts: Set chain->rtp_ctx only after avformat_write_header succeeded
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c83dd2d2a458075a58895c384372f57c1ec26276':
rtpenc_mpegts: Free the right ->pb in the error path in the init function
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Merged-by: Michael Niedermayer <michaelni@gmx.at>
By making sure we at each time only have one pointer set, either a
local variable or one in the context, we avoid potential double frees
in the cleanup routines. If chain->rtp_ctx is set, it is closed by
calling avformat_write_trailer, but that shouldn't be called unless
avformat_write_header succeeded.
This issue was pointed out by Andreas Cadhalpun.
Signed-off-by: Martin Storsjö <martin@martin.st>
* commit '8e32b1f0963d01d4f5d4803eb721f162e0d58d9a':
libavformat: Use ffio_free_dyn_buf where applicable
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'fc308b30bb24e623fed042ec78b10803b2362a18':
rtpenc_mpegts: Call write_trailer for the mpegts muxer even if no output buffer exists
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Since the mpegts muxer now can handle being called with a NULL
AVIOContext, we don't need to try to allocate one before calling
write_trailer.
Signed-off-by: Martin Storsjö <martin@martin.st>
Since this structurally is quite different from normal RTP
(multiple streams are muxed into one single mpegts stream,
which is packetized into one single RTP session), it is kept
as a separate muxer.
Since this structurally also behaves differently than normal
RTP, all of the other muxers that do chained RTP muxing
(rtsp, sap, mp4) would need to be updated similarly to handle
this - in particular, creating one single rtp_mpegts muxer
for the whole presentation instead of one rtp muxer per stream.
Signed-off-by: Martin Storsjö <martin@martin.st>
