From 6f1cad9237956235e5cf326c1e6394e5ae39433a Mon Sep 17 00:00:00 2001 From: Sebastian Rasmussen Date: Mon, 28 Sep 2015 17:40:59 +0200 Subject: [PATCH] rtsp-media: Take reference to media that will be prepared default_prepare() takes a transfer-none reference GstRTSPMedia object. Later on a g_idle_source_new() is created and a pointer to the media object is passed as user data. If the media is freed before the idle source is dispatched the media object pointer is invalid, but the idle source callback expects it to still be valid. To fix this a reference to the media object is taken when registering the source callback function and a corresponding release of the reference is done when the souce is destroyed. Fixes https://bugzilla.gnome.org/show_bug.cgi?id=755748 --- gst/rtsp-server/rtsp-media.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gst/rtsp-server/rtsp-media.c b/gst/rtsp-server/rtsp-media.c index adccff920a..5a6f758ab0 100644 --- a/gst/rtsp-server/rtsp-media.c +++ b/gst/rtsp-server/rtsp-media.c @@ -2603,7 +2603,8 @@ default_prepare (GstRTSPMedia * media, GstRTSPThread * thread) /* do remainder in context */ source = g_idle_source_new (); - g_source_set_callback (source, (GSourceFunc) start_prepare, media, NULL); + g_source_set_callback (source, (GSourceFunc) start_prepare, + g_object_ref (media), (GDestroyNotify) g_object_unref); g_source_attach (source, context); g_source_unref (source);