From: Mike Brady <mikebrady@eircom.net>
Date: Fri, 1 Feb 2019 16:17:53 +0000 (+0000)
Subject: Fix a situation where cancellation could lose a malloced buffer.
X-Git-Tag: 3.3RC0~66^2~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02bc269a4a1f4ec3d77729ffca94eb57d2652068;p=thirdparty%2Fshairport-sync.git

Fix a situation where cancellation could lose a malloced buffer.
---

diff --git a/rtsp.c b/rtsp.c
index f7c6acce..c60f859e 100644
--- a/rtsp.c
+++ b/rtsp.c
@@ -576,13 +576,13 @@ enum rtsp_read_request_response rtsp_read_request(rtsp_conn_info *conn, rtsp_mes
 
   enum rtsp_read_request_response reply = rtsp_read_request_response_ok;
   ssize_t buflen = 4096;
+  int release_buffer = 0; // on exit, don't deallocate the buffer if everything was okay
   char *buf = malloc(buflen + 1); // add a NUL at the end
   if (!buf) {
     warn("rtsp_read_request: can't get a buffer.");
-    reply = rtsp_read_request_response_error;
-    goto shutdown;
-  }
-
+    return(rtsp_read_request_response_error);
+  }  
+  pthread_cleanup_push(malloc_cleanup, buf);
   ssize_t nread;
   ssize_t inbuf = 0;
   int msg_size = -1;
@@ -717,11 +717,12 @@ do {
   char *jp = inbuf + buf;
   *jp = '\0';
   *the_packet = msg;
-  return reply;
-
 shutdown:
-  msg_free(the_packet);
-  free(buf);
+  if (reply != rtsp_read_request_response_ok) {
+    msg_free(the_packet);
+    release_buffer = 1; // allow the buffer to be released
+  }
+  pthread_cleanup_pop(release_buffer);
   return reply;
 }