From 50740a1144eb159d4e1408fc03049f8032f1fb11 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 7 Oct 2026 00:54:45 +0200
Subject: [PATCH] avformat/rtpdec_rfc4175: Free the pending frame on close

The handler had no close callback, so a frame that was not finalized
when the stream was closed leaked.

Memory leak Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report V8a3e2cGQI7w
---
 libavformat/rtpdec_rfc4175.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index cbb1afd050..a73f59e984 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -344,6 +344,11 @@ invalid:
     return missed_last_packet ? 0 : AVERROR_INVALIDDATA;
 }
 
+static void rfc4175_close_context(PayloadContext *data)
+{
+    av_freep(&data->frame);
+}
+
 const RTPDynamicProtocolHandler ff_rfc4175_rtp_handler = {
     .enc_name           = "raw",
     .codec_type         = AVMEDIA_TYPE_VIDEO,
@@ -351,4 +356,5 @@ const RTPDynamicProtocolHandler ff_rfc4175_rtp_handler = {
     .priv_data_size     = sizeof(PayloadContext),
     .parse_sdp_a_line   = rfc4175_parse_sdp_line,
     .parse_packet       = rfc4175_handle_packet,
+    .close              = rfc4175_close_context,
 };