mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-12-18 06:16:36 +00:00
Code Issues 1 Projects Releases Wiki Activity

decodebin3: Fix crash caused by slot double freeing

Browse source 
Probe for MultiQueue source pad might receive EOS twice,
the first is fake-eos and the other is actual EOS.
And the slot can be freed with fake-eos/EOS if the slot has no input.

Since slot freeing is async, double free can be possible.
So, decodebin3 needs to remove the probe also with slot freeing.

https://bugzilla.gnome.org/show_bug.cgi?id=777530
This commit is contained in:
Seungha Yang 2017-01-20 19:49:46 +09:00 committed by Edward Hervey
parent 21889bf878
commit 6b5617c2a7
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
gst/playback/gstdecodebin3-parse.c
View file

@ -585,6 +585,9 @@ parsebin_pad_removed_cb (GstElement * demux, GstPad * pad, DecodebinInput * inp)
free_output_stream (dbin, output);
}
GST_DEBUG_OBJECT (pad, "No pending pad, Remove multiqueue slot");
if (slot->probe_id)
gst_pad_remove_probe (slot->src_pad, slot->probe_id);
slot->probe_id = 0;
dbin->slots = g_list_remove (dbin->slots, slot);
free_multiqueue_slot_async (dbin, slot);
}

7
gst/playback/gstdecodebin3.c
View file

@ -1592,15 +1592,17 @@ multiqueue_src_probe (GstPad * pad, GstPadProbeInfo * info,
dbin->output_streams = g_list_remove (dbin->output_streams, output);
free_output_stream (dbin, output);
}
slot->probe_id = 0;
dbin->slots = g_list_remove (dbin->slots, slot);
free_multiqueue_slot_async (dbin, slot);
SELECTION_UNLOCK (dbin);
ret = GST_PAD_PROBE_HANDLED;
ret = GST_PAD_PROBE_REMOVE;
}
break;
case GST_EVENT_CUSTOM_DOWNSTREAM:
if (gst_event_has_name (ev, "decodebin3-custom-eos")) {
slot->is_drained = TRUE;
ret = GST_PAD_PROBE_DROP;
SELECTION_LOCK (dbin);
if (slot->input == NULL) {
GST_DEBUG_OBJECT (pad,
@ -1612,11 +1614,12 @@ multiqueue_src_probe (GstPad * pad, GstPadProbeInfo * info,
g_list_remove (dbin->output_streams, output);
free_output_stream (dbin, output);
}
slot->probe_id = 0;
dbin->slots = g_list_remove (dbin->slots, slot);
free_multiqueue_slot_async (dbin, slot);
ret = GST_PAD_PROBE_REMOVE;
}
SELECTION_UNLOCK (dbin);
ret = GST_PAD_PROBE_DROP;
}
break;
default: