From ee4cbb11999aabb321da32c106204836b5a3498b Mon Sep 17 00:00:00 2001 From: Richard Stanway Date: Sun, 23 Feb 2020 00:21:58 +0100 Subject: [PATCH] obs-outputs: Properly reset stream count on RTMP_Close Every addStream call would increment this counter. After merging the mbedTLS fixes, we no longer have extraneous RTMP_Init calls which were masking the prescence of this bug. This caused every stream after the first stream to have the wrong channel index, and eventually OBS would crash due to an out of bounds write if the counter reached RTMP_MAX_STREAMS. --- plugins/obs-outputs/librtmp/rtmp.c | 6 +++--- plugins/obs-outputs/rtmp-stream.c | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/plugins/obs-outputs/librtmp/rtmp.c b/plugins/obs-outputs/librtmp/rtmp.c index 81ab5c862..446193773 100644 --- a/plugins/obs-outputs/librtmp/rtmp.c +++ b/plugins/obs-outputs/librtmp/rtmp.c @@ -4361,11 +4361,11 @@ RTMP_Close(RTMP *r) free(r->Link.streams[idx].playpath.av_val); r->Link.streams[idx].playpath.av_val = NULL; } - - r->Link.curStreamIdx = 0; - r->Link.nStreams = 0; } + r->Link.curStreamIdx = 0; + r->Link.nStreams = 0; + if ((r->Link.protocol & RTMP_FEATURE_WRITE) && (r->Link.pFlags & RTMP_PUB_CLEAN) && (r->Link.pFlags & RTMP_PUB_ALLOC)) diff --git a/plugins/obs-outputs/rtmp-stream.c b/plugins/obs-outputs/rtmp-stream.c index 90a0b893e..9edeb6489 100644 --- a/plugins/obs-outputs/rtmp-stream.c +++ b/plugins/obs-outputs/rtmp-stream.c @@ -407,6 +407,8 @@ static int send_packet(struct rtmp_stream *stream, int recv_size = 0; int ret = 0; + assert(idx < RTMP_MAX_STREAMS); + if (!stream->new_socket_loop) { #ifdef _WIN32 ret = ioctlsocket(stream->rtmp.m_sb.sb_socket, FIONREAD,