From 3506f5fb0702f29e69ce791e851a3b2c6e3c8112 Mon Sep 17 00:00:00 2001
From: Thibault Saunier <tsaunier@igalia.com>
Date: Thu, 29 Aug 2024 12:10:23 -0400
Subject: [PATCH] osxaudio: Avoid dangling pointer on shutdown

When tearing down the elements we were still referring to the ringbuffer unique_id
as our property while it was already freed, leading to potential segfaults when
accessing the property.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/7426>
---
 .../gst-plugins-good/sys/osxaudio/gstosxaudiosink.c  | 10 ++++++++++
 .../gst-plugins-good/sys/osxaudio/gstosxaudiosrc.c   | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosink.c b/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosink.c
index 51566dc620..ce70277e3a 100644
--- a/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosink.c
+++ b/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosink.c
@@ -248,6 +248,12 @@ gst_osx_audio_sink_change_state (GstElement * element,
   GstStateChangeReturn ret;
 
   switch (transition) {
+    case GST_STATE_CHANGE_READY_TO_NULL:
+      GST_OBJECT_LOCK (osxsink);
+      osxsink->device_id = kAudioDeviceUnknown;
+      osxsink->unique_id = NULL;
+      GST_OBJECT_UNLOCK (osxsink);
+      break;
     default:
       break;
   }
@@ -265,8 +271,10 @@ gst_osx_audio_sink_change_state (GstElement * element,
       ringbuffer =
           GST_OSX_AUDIO_RING_BUFFER (GST_AUDIO_BASE_SINK (osxsink)->ringbuffer);
       if (ringbuffer->core_audio->device_id != osxsink->device_id) {
+        GST_OBJECT_LOCK (osxsink);
         osxsink->device_id = ringbuffer->core_audio->device_id;
         osxsink->unique_id = ringbuffer->core_audio->unique_id;
+        GST_OBJECT_UNLOCK (osxsink);
         g_object_notify (G_OBJECT (osxsink), "device");
       }
       break;
@@ -290,7 +298,9 @@ gst_osx_audio_sink_get_property (GObject * object, guint prop_id,
       g_value_set_int (value, sink->device_id);
       break;
     case ARG_UNIQUE_ID:
+      GST_OBJECT_LOCK (sink);
       g_value_set_string (value, sink->unique_id);
+      GST_OBJECT_UNLOCK (sink);
       break;
 #endif
     case ARG_VOLUME:
diff --git a/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosrc.c b/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosrc.c
index 066341efb6..5ac7966e71 100644
--- a/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosrc.c
+++ b/subprojects/gst-plugins-good/sys/osxaudio/gstosxaudiosrc.c
@@ -207,7 +207,9 @@ gst_osx_audio_src_get_property (GObject * object, guint prop_id,
       g_value_set_int (value, src->device_id);
       break;
     case ARG_UNIQUE_ID:
+      GST_OBJECT_LOCK (src);
       g_value_set_string (value, src->unique_id);
+      GST_OBJECT_UNLOCK (src);
       break;
     default:
       G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
@@ -223,6 +225,13 @@ gst_osx_audio_src_change_state (GstElement * element, GstStateChange transition)
   GstStateChangeReturn ret;
 
   switch (transition) {
+    case GST_STATE_CHANGE_READY_TO_NULL:{
+      GST_OBJECT_LOCK (osxsrc);
+      osxsrc->device_id = kAudioDeviceUnknown;
+      osxsrc->unique_id = NULL;
+      GST_OBJECT_UNLOCK (osxsrc);
+      break;
+    }
     default:
       break;
   }
@@ -237,8 +246,11 @@ gst_osx_audio_src_change_state (GstElement * element, GstStateChange transition)
       ringbuffer =
           GST_OSX_AUDIO_RING_BUFFER (GST_AUDIO_BASE_SRC (osxsrc)->ringbuffer);
       if (ringbuffer->core_audio->device_id != osxsrc->device_id) {
+        GST_OBJECT_LOCK (osxsrc);
         osxsrc->device_id = ringbuffer->core_audio->device_id;
         osxsrc->unique_id = ringbuffer->core_audio->unique_id;
+        GST_OBJECT_UNLOCK (osxsrc);
+
         g_object_notify (G_OBJECT (osxsrc), "device");
       }
       break;