[vlc-devel] commit: Revert "RTMP: factorization" ( Rémi Duraffort )

[git version control]

vlc | branch: master | Rémi Duraffort <ivoire at videolan.org> | Wed Nov 18 12:41:36 2009 +0100| [1389ca04cb51fc10406db9553ffccba637ea4dbc] | committer: Rémi Duraffort 

Revert "RTMP: factorization"

This commit add a deref-after-free bug.

This reverts commit 25cbae45cda4530fc9968edf067fd0f59ee9d8fe.

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=1389ca04cb51fc10406db9553ffccba637ea4dbc
---

 modules/access/rtmp/access.c |   25 ++++++++++++++++---------
 1 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/modules/access/rtmp/access.c b/modules/access/rtmp/access.c
index 24df9a4..d68ec00 100644
--- a/modules/access/rtmp/access.c
+++ b/modules/access/rtmp/access.c
@@ -404,15 +404,19 @@ static ssize_t Read( access_t *p_access, uint8_t *p_buffer, size_t i_len )
             tmp_buffer = rtmp_encode_packet( p_sys->p_thread, rtmp_packet );
 
             i_ret = net_Write( p_sys->p_thread, p_sys->p_thread->fd, NULL, tmp_buffer, rtmp_packet->length_encoded );
-            free( rtmp_packet->body->body );
-            free( rtmp_packet->body );
-            free( rtmp_packet );
-            free( tmp_buffer );
             if( i_ret != rtmp_packet->length_encoded )
             {
+                free( rtmp_packet->body->body );
+                free( rtmp_packet->body );
+                free( rtmp_packet );
+                free( tmp_buffer );
                 msg_Err( p_access, "failed send publish start" );
                 return -1;
             }
+            free( rtmp_packet->body->body );
+            free( rtmp_packet->body );
+            free( rtmp_packet );
+            free( tmp_buffer );
         }
 
         p_access->info.i_pos += i_len_tmp;
@@ -422,16 +426,19 @@ static ssize_t Read( access_t *p_access, uint8_t *p_buffer, size_t i_len )
         tmp_buffer = rtmp_encode_packet( p_sys->p_thread, rtmp_packet );
  
         i_ret = net_Write( p_sys->p_thread, p_sys->p_thread->fd, NULL, tmp_buffer, rtmp_packet->length_encoded );
-        free( rtmp_packet->body->body );
-        free( rtmp_packet->body );
-        free( rtmp_packet );
-        free( tmp_buffer );
-
         if( i_ret != rtmp_packet->length_encoded )
         {
+            free( rtmp_packet->body->body );
+            free( rtmp_packet->body );
+            free( rtmp_packet );
+            free( tmp_buffer );
             msg_Err( p_access, "failed send bytes read" );
             return -1;
         }
+        free( rtmp_packet->body->body );
+        free( rtmp_packet->body );
+        free( rtmp_packet );
+        free( tmp_buffer );
     }
 
     return i_len_tmp;