RTMP: fix memory leak and use after free on error paths

diff --git a/modules/access_output/rtmp.c b/modules/access_output/rtmp.c
index b49181a1a89817dc996d32eaf82b1f5994725ed5..39944466048f56ae10aec598efd5b7e77892dab5 100644 (file)
--- a/modules/access_output/rtmp.c
+++ b/modules/access_output/rtmp.c
@@ -96,7 +96,10 @@ static int Open( vlc_object_t *p_this )
     p_sys->p_thread =
         vlc_object_create( p_access, sizeof( rtmp_control_thread_t ) );
     if( !p_sys->p_thread )
+    {
+        free( p_sys );
         return VLC_ENOMEM;
+    }
     vlc_object_attach( p_sys->p_thread, p_access );
 
     /* Parse URI - remove spaces */
@@ -247,10 +250,9 @@ error2:
     if( p_sys->p_thread->fd != -1 )
         net_Close( p_sys->p_thread->fd );
 error:
+    vlc_UrlClean( &p_sys->p_thread->url );
     vlc_object_detach( p_sys->p_thread );
     vlc_object_release( p_sys->p_thread );
-
-    vlc_UrlClean( &p_sys->p_thread->url );
     free( p_sys );
 
     return VLC_EGENERIC;