Race condition between RTSP server and the PAUSE command causing a crash.

[jean343]

A race condition exists between the RTSP server and the PAUSE command, leading to a crash with a nil pointer dereference. The crash occurs when writePacketRTPInQueueTCP attempts to access tcpConn after it has been set to nil by the PAUSE command.

Stack trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x85bcd7]

goroutine 3932 [running]:
github.com/bluenviron/gortsplib/v4.(*serverSessionFormat).writePacketRTPInQueueTCP(0xc0124ae300, {0xc000b61800?, 0x5c0, 0x5bca6e?})
        /go/pkg/mod/github.com/bluenviron/gortsplib/v4@v4.12.2/server_session_format.go:142 +0x97
github.com/bluenviron/gortsplib/v4.(*ServerSession).writePacketRTP.func1()
        /go/pkg/mod/github.com/bluenviron/gortsplib/v4@v4.12.2/server_session.go:1478 +0x27
github.com/bluenviron/gortsplib/v4.(*asyncProcessor).runInner(0xc008d38090)
        /go/pkg/mod/github.com/bluenviron/gortsplib/v4@v4.12.2/async_processor.go:49 +0x3e
github.com/bluenviron/gortsplib/v4.(*asyncProcessor).run(...)
        /go/pkg/mod/github.com/bluenviron/gortsplib/v4@v4.12.2/async_processor.go:38
created by github.com/bluenviron/gortsplib/v4.(*asyncProcessor).start in goroutine 3970
        /go/pkg/mod/github.com/bluenviron/gortsplib/v4@v4.12.2/async_processor.go:34 +0x8e

Root Cause

The lock in writePacketRTP does not guard writePacketRTPInQueue as it's running in an async process. Additionally, the lock is not acquired during the pause command.
The PAUSE command sets ss.tcpConn = nil.
The async writePacketRTPInQueueTCP attempts to use tcpConn.nconn.SetWriteDeadline, leading to a nil pointer dereference.

Testing

Simulated rapid PAUSE and RESUME calls to verify stability.

In our case,
Launch ffplay -i rtsp://localhost:8554/a
Play and pause repeatability by holding the p key.

[aler9]

Thank you very much for reporting the issue and providing a patch. This is fixed in a more efficient way by #692