Commit 219df9ea00 for ffmpeg
commit 219df9ea0037bdeef6ef425905ec0026bb58e33a
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed Nov 11 22:45:24 2026 +0100
avformat/rtmpdh: leave freeing the private key to ff_dh_free()
Fixes: double free
Fixes: QqzZphPWboPU
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25059
Double free Replicated through Modified FFmpeg with ASAN
diff --git a/libavformat/rtmpdh.c b/libavformat/rtmpdh.c
index 1ed1a52c49..f5ec9e15e3 100644
--- a/libavformat/rtmpdh.c
+++ b/libavformat/rtmpdh.c
@@ -238,10 +238,8 @@ static FFBigNum dh_generate_key(FF_DH *dh)
bn_random(dh->priv_key, 8 * num_bytes);
bn_new(dh->pub_key);
- if (!dh->pub_key) {
- bn_free(dh->priv_key);
+ if (!dh->pub_key)
return NULL;
- }
if (bn_modexp(dh->pub_key, dh->g, dh->priv_key, dh->p) < 0)
return NULL;