PR #22272 opened by Nariman-Sayed
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22272
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22272.patch

ffurl_closep sets the pointer to NULL after freeing,
preventing potential use-after-free if whip_deinit
is called more than once or in error paths.

The adjacent ffurl_closep(&whip->udp) call already
uses the correct function, this fixes the inconsistency.


>From 34856f6d3a4a12f3535eb6ac632815565e4200af Mon Sep 17 00:00:00 2001
From: Nariman-Sayed <[email protected]>
Date: Mon, 23 Feb 2026 23:38:41 +0200
Subject: [PATCH] avformat/whip: use ffurl_closep instead of ffurl_close for
 dtls_uc

---
 libavformat/whip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/whip.c b/libavformat/whip.c
index fda5fed40c..08bd19d9c7 100644
--- a/libavformat/whip.c
+++ b/libavformat/whip.c
@@ -1999,7 +1999,7 @@ static av_cold void whip_deinit(AVFormatContext *s)
     ff_srtp_free(&whip->srtp_video_rtx_send);
     ff_srtp_free(&whip->srtp_rtcp_send);
     ff_srtp_free(&whip->srtp_recv);
-    ffurl_close(whip->dtls_uc);
+    ffurl_closep(&whip->dtls_uc);
     ffurl_closep(&whip->udp);
     av_freep(&whip->dtls_fingerprint);
 }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to