From 08dbed31d5453f883928f2779f22bda8b246a228 Mon Sep 17 00:00:00 2001
From: Max Dymond <cmeister2@gmail.com>
Date: Tue, 12 Sep 2017 19:45:19 +0100
Subject: [PATCH] rtsp: Segfault in rtsp.c when using WRITEDATA

If the INTERLEAVEFUNCTION is defined, then use that plus the
INTERLEAVEDATA information when writing RTP. Otherwise, use
WRITEFUNCTION and WRITEDATA.

Fixes #1880
Closes #1884
---
 lib/rtsp.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/lib/rtsp.c b/lib/rtsp.c
index 99ec5f4dc..925da2c1a 100644
--- a/lib/rtsp.c
+++ b/lib/rtsp.c
@@ -749,23 +749,28 @@ CURLcode rtp_client_write(struct connectdata *conn, char *ptr, size_t len)
   struct Curl_easy *data = conn->data;
   size_t wrote;
   curl_write_callback writeit;
+  void *user_ptr;
 
   if(len == 0) {
     failf(data, "Cannot write a 0 size RTP packet.");
     return CURLE_WRITE_ERROR;
   }
 
-  writeit = data->set.fwrite_rtp?data->set.fwrite_rtp:data->set.fwrite_func;
-
-  if(!data->set.fwrite_rtp && !data->set.is_fwrite_set &&
-     !data->set.rtp_out) {
-    /* if no callback is set for either RTP or default, the default function
-       fwrite() is utilized and that can't handle a NULL input */
-    failf(data, "No destination to default data callback!");
-    return CURLE_WRITE_ERROR;
+  /* If the user has configured CURLOPT_INTERLEAVEFUNCTION then use that
+     function and any configured CURLOPT_INTERLEAVEDATA to write out the RTP
+     data. Otherwise, use the CURLOPT_WRITEFUNCTION with the CURLOPT_WRITEDATA
+     pointer to write out the RTP data. */
+  if(data->set.fwrite_rtp) {
+    writeit = data->set.fwrite_rtp;
+    user_ptr = data->set.rtp_out;
+  }
+  else
+  {
+    writeit = data->set.fwrite_func;
+    user_ptr = data->set.out;
   }
 
-  wrote = writeit(ptr, 1, len, data->set.rtp_out);
+  wrote = writeit(ptr, 1, len, user_ptr);
 
   if(CURL_WRITEFUNC_PAUSE == wrote) {
     failf(data, "Cannot pause RTP");