rtmpsink: fix memory leak from URI verification via RTMP_ParseURL()

In gst_rtmp_sink_uri_set_uri(), a test is performed in order
to be sure uri is correct for librtmp. This test calls
RTMP_ParseURL with 3 AVal pointers as parameters: host,
playpath and app.

AVal is a struct with a char* + int. After RTMP_ParseURL call,
host.av_val and app.av_val both refer a substring of "uri". But
playpath.av_val may be the result of a malloc so it needs to
be freed.

https://bugzilla.gnome.org/show_bug.cgi?id=681459

1 files changed, 12 insertions, 4 deletions

diff --git a/ext/rtmp/gstrtmpsink.c b/ext/rtmp/gstrtmpsink.c
index b22b9d913..8caa80fcd 100644
--- a/ext/rtmp/gstrtmpsink.c
+++ b/ext/rtmp/gstrtmpsink.c
@@ -47,6 +47,8 @@
 #include <winsock2.h>
 #endif
 
+#include <stdlib.h>
+
 GST_DEBUG_CATEGORY_STATIC (gst_rtmp_sink_debug);
 #define GST_CAT_DEFAULT gst_rtmp_sink_debug
 
@@ -293,6 +295,7 @@ gst_rtmp_sink_uri_set_uri (GstURIHandler * handler, const gchar * uri,
     GError ** error)
 {
   GstRTMPSink *sink = GST_RTMP_SINK (handler);
+  gboolean ret = TRUE;
 
   if (GST_STATE (sink) >= GST_STATE_PAUSED) {
     g_set_error (error, GST_URI_ERROR, GST_URI_ERROR_BAD_STATE,
@@ -315,14 +318,19 @@ gst_rtmp_sink_uri_set_uri (GstURIHandler * handler, const gchar * uri,
           ("Failed to parse URI %s", uri), (NULL));
       g_set_error (error, GST_URI_ERROR, GST_URI_ERROR_BAD_URI,
           "Could not parse RTMP URI");
-      return FALSE;
+      ret = FALSE;
+    } else {
+      sink->uri = g_strdup (uri);
     }
-    sink->uri = g_strdup (uri);
+
+    if (playpath.av_val)
+      free (playpath.av_val);
   }
 
-  GST_DEBUG_OBJECT (sink, "Changed URI to %s", GST_STR_NULL (uri));
+  if (ret)
+    GST_DEBUG_OBJECT (sink, "Changed URI to %s", GST_STR_NULL (uri));
 
-  return TRUE;
+  return ret;
 }
 
 static void