From 0a359cdbdce7d85b05582c988831db502793f828 Mon Sep 17 00:00:00 2001 From: Patrick Radizi Date: Thu, 11 Dec 2014 10:16:06 +0100 Subject: [PATCH] rtph264pay: fix potential crash when shutting down A race condition in the state change function may cause buffers to be unreffed while they are still used by the streaming thread in gst_rtp_h264_pay_send_sps_pps() resulting in a crash. Chain up to the parent class first in the state change function to make sure streaming has stopped and only then free those buffers. https://bugzilla.gnome.org/show_bug.cgi?id=741381 --- gst/rtp/gstrtph264pay.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/gst/rtp/gstrtph264pay.c b/gst/rtp/gstrtph264pay.c index 8590d99352..ba5e4b3401 100644 --- a/gst/rtp/gstrtph264pay.c +++ b/gst/rtp/gstrtph264pay.c @@ -1336,6 +1336,13 @@ gst_rtp_h264_pay_change_state (GstElement * element, GstStateChange transition) rtph264pay->send_spspps = FALSE; gst_adapter_clear (rtph264pay->adapter); break; + default: + break; + } + + ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition); + + switch (transition) { case GST_STATE_CHANGE_PAUSED_TO_READY: rtph264pay->last_spspps = -1; gst_rtp_h264_pay_clear_sps_pps (rtph264pay); @@ -1344,8 +1351,6 @@ gst_rtp_h264_pay_change_state (GstElement * element, GstStateChange transition) break; } - ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition); - return ret; }