From 63d3ba4dfbd962966cffea93808d46c35c1a61b1 Mon Sep 17 00:00:00 2001 From: Jan Schmidt Date: Fri, 24 Jun 2022 02:54:22 +1000 Subject: [PATCH] adaptivedemux2: Fix memory leaks and use-after-free Fix various small memory leaks, and an invalid access to GstEvent after giving away the ref via gst_pad_push_event() Part-of: --- .../ext/adaptivedemux2/gstadaptivedemux.c | 6 +++++- .../ext/adaptivedemux2/gstadaptivedemuxutils.c | 12 +++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c index 3e109f131e..2e977dcb4e 100644 --- a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c +++ b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c @@ -1163,6 +1163,9 @@ gst_adaptive_demux_handle_upstream_http_header (GQuark field_id, g_free (date_string); gst_adaptive_demux_clock_set_utc_time (demux->realtime_clock, utc_now); + + g_date_time_unref (utc_now); + gst_date_time_unref (datetime); } } } @@ -3669,10 +3672,11 @@ restart: GstEvent *event = (GstEvent *) mo; if (GST_EVENT_TYPE (event) == GST_EVENT_GAP) slot->pushed_timed_data = TRUE; - gst_pad_push_event (slot->pad, event); + gst_pad_push_event (slot->pad, gst_event_ref (event)); if (GST_EVENT_IS_STICKY (event)) gst_event_store_mark_delivered (&track->sticky_events, event); + gst_event_unref (event); } else if (GST_IS_BUFFER (mo)) { GstBuffer *buffer = (GstBuffer *) mo; diff --git a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c index c0cd9a3762..994a94b945 100644 --- a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c +++ b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c @@ -229,7 +229,7 @@ void gst_adaptive_demux_loop_start (GstAdaptiveDemuxLoop * loop) { g_mutex_lock (&loop->lock); - if (loop->thread != NULL && !loop->stopped) + if (loop->thread != NULL) goto done; /* Already running */ loop->stopped = FALSE; @@ -255,9 +255,10 @@ void gst_adaptive_demux_loop_stop (GstAdaptiveDemuxLoop * loop, gboolean wait) { g_mutex_lock (&loop->lock); - loop->stopped = TRUE; - if (loop->loop != NULL) { + if (!loop->stopped) { + loop->stopped = TRUE; + GSource *s = g_idle_source_new (); g_source_set_callback (s, (GSourceFunc) do_quit_cb, gst_adaptive_demux_loop_ref (loop), @@ -269,6 +270,11 @@ gst_adaptive_demux_loop_stop (GstAdaptiveDemuxLoop * loop, gboolean wait) while (loop->loop != NULL) g_cond_wait (&loop->cond, &loop->lock); } + + if (loop->thread != NULL) { + g_thread_unref (loop->thread); + loop->thread = NULL; + } } g_mutex_unlock (&loop->lock);