From 17781cba1c31e042120227df8b4d5531d875c5d3 Mon Sep 17 00:00:00 2001
From: William King <william.king@quentustech.com>
Date: Thu, 2 May 2013 23:57:43 -0500
Subject: [PATCH] FS-5240: --resolve Please test

---
 src/mod/endpoints/mod_rtmp/libamf/src/amf0.c | 49 ++++++++++++--------
 src/mod/endpoints/mod_rtmp/mod_rtmp.c        |  2 -
 src/mod/endpoints/mod_rtmp/rtmp_tcp.c        | 12 ++++-
 3 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/src/mod/endpoints/mod_rtmp/libamf/src/amf0.c b/src/mod/endpoints/mod_rtmp/libamf/src/amf0.c
index 67a9273e2b..e62b3098f5 100644
--- a/src/mod/endpoints/mod_rtmp/libamf/src/amf0.c
+++ b/src/mod/endpoints/mod_rtmp/libamf/src/amf0.c
@@ -201,17 +201,22 @@ static amf0_data * amf0_boolean_read(read_proc_t read_proc, void * user_data) {
 
 /* read a string */
 static amf0_data * amf0_string_read(read_proc_t read_proc, void * user_data) {
-    uint16_t strsize;
-    uint8_t * buffer;
+  uint16_t strsize;
+  uint8_t * buffer = NULL;
+  amf0_data *data = NULL;
     if (read_proc(&strsize, sizeof(uint16_t), user_data) == sizeof(uint16_t)) {
         strsize = swap_uint16(strsize);
         if (strsize > 0) {
-            buffer = (uint8_t*)calloc(strsize, sizeof(uint8_t));
-            if (buffer != NULL && read_proc(buffer, strsize, user_data) == strsize) {
-                amf0_data * data = amf0_string_new(buffer, strsize);
-                free(buffer);
-                return data;
-            }
+	  buffer = (uint8_t*) calloc(strsize, sizeof(uint8_t));
+	  if ( buffer == NULL ) {
+	    return NULL; // Memory error
+	  }
+	  if ( read_proc(buffer, strsize, user_data) == strsize ) {
+	    data = amf0_string_new(buffer, strsize);
+	  }
+	  free(buffer);
+	  buffer = NULL;
+	  return data;
         }
         else {
             return amf0_string_new(NULL, 0);
@@ -634,9 +639,11 @@ void amf0_data_free(amf0_data * data) {
             case AMF0_TYPE_NUMBER: break;
             case AMF0_TYPE_BOOLEAN: break;
             case AMF0_TYPE_STRING:
-                if (data->u.string_data.mbstr != NULL) {
+                if (data->u.string_data.mbstr) {
                     free(data->u.string_data.mbstr);
-                } break;
+		    data->u.string_data.mbstr = NULL;
+                } 
+		break;
             case AMF0_TYPE_NULL: break;
             case AMF0_TYPE_UNDEFINED: break;
             /*case AMF0_TYPE_REFERENCE:*/
@@ -812,17 +819,19 @@ uint32_t amf0_object_size(amf0_data * data) {
 }
 
 amf0_data * amf0_object_add(amf0_data * data, const char * name, amf0_data * element) {
-    if (data != NULL) {
-        if (amf0_list_push(&data->u.list_data, amf0_str(name)) != NULL) {
-            if (amf0_list_push(&data->u.list_data, element) != NULL) {
-                return element;
-            }
-            else {
-                amf0_data_free(amf0_list_pop(&data->u.list_data));
-            }
-        }
+  if (data != NULL) {
+    amf0_data *str_name = amf0_str(name);
+    if (amf0_list_push(&data->u.list_data, str_name) != NULL) {
+      if (amf0_list_push(&data->u.list_data, element) != NULL) {
+	return element;
+      }
+      else {
+	amf0_data_free(amf0_list_pop(&data->u.list_data));
+      }
     }
-    return NULL;
+    amf0_data_free(str_name);
+  }
+  return NULL;
 }
 
 amf0_data * amf0_object_get(amf0_data * data, const char * name) {
diff --git a/src/mod/endpoints/mod_rtmp/mod_rtmp.c b/src/mod/endpoints/mod_rtmp/mod_rtmp.c
index 36c295a274..002b17bbc8 100644
--- a/src/mod/endpoints/mod_rtmp/mod_rtmp.c
+++ b/src/mod/endpoints/mod_rtmp/mod_rtmp.c
@@ -871,8 +871,6 @@ switch_status_t rtmp_session_destroy(rtmp_session_t **rsession)
 	switch_thread_rwlock_wrlock((*rsession)->rwlock);
 	switch_thread_rwlock_unlock((*rsession)->rwlock);
 	
-	(*rsession)->profile->io->close(*rsession);
-	
 #ifdef RTMP_DEBUG_IO
 	fclose((*rsession)->io_debug_in);
 	fclose((*rsession)->io_debug_out);
diff --git a/src/mod/endpoints/mod_rtmp/rtmp_tcp.c b/src/mod/endpoints/mod_rtmp/rtmp_tcp.c
index 04ab087eb4..1e5fd118ad 100644
--- a/src/mod/endpoints/mod_rtmp/rtmp_tcp.c
+++ b/src/mod/endpoints/mod_rtmp/rtmp_tcp.c
@@ -176,8 +176,16 @@ static switch_status_t rtmp_tcp_close(rtmp_session_t *rsession)
 		switch_mutex_unlock(io->mutex);
 
 		switch_socket_close(io_pvt->socket);
-		io_pvt->socket = NULL;	
+		io_pvt->socket = NULL;
 	}
+
+	if ( io_pvt->sendq ) {
+		switch_buffer_destroy(&(io_pvt->sendq));
+	}
+	
+	free(rsession->io_private);
+	rsession->io_private = NULL;
+
 	return SWITCH_STATUS_SUCCESS;
 }
 
@@ -276,6 +284,8 @@ void *SWITCH_THREAD_FUNC rtmp_io_tcp_thread(switch_thread_t *thread, void *obj)
 					
 					switch_socket_close(io_pvt->socket);
 					io_pvt->socket = NULL;
+
+					io->base.close(rsession);
 					
 					rtmp_session_destroy(&rsession);
 				}