fix: hold shared_ptr to self in RtpConnection trigger lambda

SendRtpPacket queues a lambda onto the RtspConnection's task scheduler
ring buffer; the scheduler runs it on the event-loop thread later. The
lambda captured raw `this`, so if the RtpConnection was destroyed
between enqueue and execution (client disconnect, session teardown,
shutdown drain) the deferred callback dereferenced freed memory and
crashed deep in the xop send path, with the originating stack pointing
at ZoneMinderFifoSource::WriteRun's PushFrame call.

Make RtpConnection inherit from std::enable_shared_from_this and have
the lambda capture `auto self = shared_from_this()`, so the connection
stays alive at least until every queued trigger has fired. All
RtpConnections are already owned via shared_ptr (RtspConnection::rtp_conn_,
MediaSession::clients_ weak_ptr lifted at the send site), so adopting
shared_from_this here is safe. The same shared-ptr-capture pattern is
already used in TcpConnection::AddTriggerEvent.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Isaac Connor

src/xop/RtpConnection.cpp

@@ -247,19 +247,25 @@ int RtpConnection::SendRtpPacket(MediaChannelId channel_id, RtpPacket pkt)
 
 	RtspConnection *rtsp_conn = (RtspConnection *)conn.get();
 
-	bool ret = rtsp_conn->task_scheduler_->AddTriggerEvent([this, channel_id, pkt] {
-		this->SetFrameType(pkt.type);
-		this->SetRtpHeader(channel_id, pkt);
-		if((media_channel_info_[channel_id].is_play || media_channel_info_[channel_id].is_record) && has_key_frame_ ) {            
-			if(transport_mode_ == RTP_OVER_TCP) {
-				SendRtpOverTcp(channel_id, pkt);
+	// Capture a shared_ptr to self so the trigger lambda cannot UAF if the
+	// RtpConnection is destroyed between enqueue and the event-loop thread
+	// invoking it (e.g. client disconnect, session teardown). Previously the
+	// lambda captured raw `this`, which crashed deep in xop send paths when
+	// the connection went away before the scheduler drained the queue.
+	auto self = shared_from_this();
+	bool ret = rtsp_conn->task_scheduler_->AddTriggerEvent([self, channel_id, pkt] {
+		self->SetFrameType(pkt.type);
+		self->SetRtpHeader(channel_id, pkt);
+		if((self->media_channel_info_[channel_id].is_play || self->media_channel_info_[channel_id].is_record) && self->has_key_frame_ ) {
+			if(self->transport_mode_ == RTP_OVER_TCP) {
+				self->SendRtpOverTcp(channel_id, pkt);
 			}
 			else {
-				SendRtpOverUdp(channel_id, pkt);
+				self->SendRtpOverUdp(channel_id, pkt);
 			}
-                   
-			//media_channel_info_[channel_id].octetCount  += pkt.size;
-			//media_channel_info_[channel_id].packetCount += 1;
+
+			//self->media_channel_info_[channel_id].octetCount  += pkt.size;
+			//self->media_channel_info_[channel_id].packetCount += 1;
 		}
 	});
 

src/xop/RtpConnection.h

@@ -19,7 +19,7 @@ namespace xop
 
 class RtspConnection;
 
-class RtpConnection
+class RtpConnection : public std::enable_shared_from_this<RtpConnection>
 {
 public:
     RtpConnection(std::weak_ptr<TcpConnection> rtsp_connection);