From adb044c9ed4edfd90f3df2a5fb986415459e804f Mon Sep 17 00:00:00 2001
From: Ognyan Tonchev <ognyan@axis.com>
Date: Tue, 14 Jul 2020 13:14:09 +0200
Subject: [PATCH] rtspsrc: Fix segfault with illegal free

set_get_param_q is not a pointer so it is illegal to call g_queue_free_full().
Freeing the requests by popping them from the queue instead.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/669>
---
 gst/rtsp/gstrtspsrc.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/gst/rtsp/gstrtspsrc.c b/gst/rtsp/gstrtspsrc.c
index 603bdf0982..ab794d4239 100644
--- a/gst/rtsp/gstrtspsrc.c
+++ b/gst/rtsp/gstrtspsrc.c
@@ -1438,15 +1438,6 @@ free_param_data (ParameterRequest * req)
   g_free (req);
 }
 
-static void
-free_param_queue (gpointer data)
-{
-  ParameterRequest *req = data;
-
-  gst_promise_expire (req->promise);
-  free_param_data (req);
-}
-
 static void
 gst_rtspsrc_finalize (GObject * object)
 {
@@ -2422,6 +2413,7 @@ static void
 gst_rtspsrc_cleanup (GstRTSPSrc * src)
 {
   GList *walk;
+  ParameterRequest *req;
 
   GST_DEBUG_OBJECT (src, "cleanup");
 
@@ -2471,9 +2463,10 @@ gst_rtspsrc_cleanup (GstRTSPSrc * src)
 
   GST_OBJECT_LOCK (src);
   /* free parameter requests queue */
-  if (!g_queue_is_empty (&src->set_get_param_q))
-    g_queue_free_full (&src->set_get_param_q, free_param_queue);
-
+  while ((req = g_queue_pop_head (&src->set_get_param_q))) {
+    gst_promise_expire (req->promise);
+    free_param_data (req);
+  }
   GST_OBJECT_UNLOCK (src);
 
 }