From b3586c2f3b11eb41dd3095215831c90fcb2c9a0a Mon Sep 17 00:00:00 2001
From: Jaroslav Kysela <perex@perex.cz>
Date: Wed, 17 Sep 2014 14:53:58 +0200
Subject: [PATCH] tsfix (matroska, htsp): fix memory leaks (refcounting)

---
 src/plumbing/tsfix.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/plumbing/tsfix.c b/src/plumbing/tsfix.c
index 2a8a554b..09f69c28 100644
--- a/src/plumbing/tsfix.c
+++ b/src/plumbing/tsfix.c
@@ -237,6 +237,9 @@ recover_pts(tsfix_t *tf, tfstream_t *tfs, th_pkt_t *pkt)
   while((pr = TAILQ_FIRST(&tf->tf_ptsq)) != NULL) {
     
     pkt = pr->pr_pkt;
+    TAILQ_REMOVE(&tf->tf_ptsq, pr, pr_link);
+    free(pr);
+
     tfs = tfs_find(tf, pkt);
 
     switch(tfs->tfs_type) {
@@ -258,8 +261,10 @@ recover_pts(tsfix_t *tf, tfstream_t *tfs, th_pkt_t *pkt)
 	   try to find it */
 	srch = TAILQ_NEXT(pr, pr_link);
 	while(1) {
-	  if(srch == NULL)
+	  if(srch == NULL) {
+	    pkt_ref_dec(pkt);
 	    return; /* not arrived yet, wait */
+          }
 	  if(tfs_find(tf, srch->pr_pkt) == tfs && 
 	     srch->pr_pkt->pkt_frametype <= PKT_P_FRAME) {
 	    pkt->pkt_pts = srch->pr_pkt->pkt_dts;
@@ -278,9 +283,7 @@ recover_pts(tsfix_t *tf, tfstream_t *tfs, th_pkt_t *pkt)
       break;
     }
 
-    TAILQ_REMOVE(&tf->tf_ptsq, pr, pr_link);
     normalize_ts(tf, tfs, pkt);
-    free(pr);
   }
 }
 
@@ -360,15 +363,19 @@ tsfix_input(void *opaque, streaming_message_t *sm)
 
   switch(sm->sm_type) {
   case SMT_PACKET:
-    if (tf->tf_wait_for_video)
+    if (tf->tf_wait_for_video) {
+      streaming_msg_free(sm);
       return;
+    }
     tsfix_input_packet(tf, sm);
     return;
 
   case SMT_START:
     tsfix_start(tf, sm->sm_data);
-    if (tf->tf_wait_for_video)
+    if (tf->tf_wait_for_video) {
+      streaming_msg_free(sm);
       return;
+    }
     break;
 
   case SMT_STOP: