From df724c410b02b82bd7db893d24e8572a06c2fcb1 Mon Sep 17 00:00:00 2001 From: Luis de Bethencourt Date: Sat, 15 Aug 2015 11:30:36 +0100 Subject: [PATCH] rtph265pay: fix potential crash when shutting down A race condition in the state change function may cause buffers to be unreffed while they are still used by the streaming thread in gst_rtp_h265_pay_send_vps_sps_pps() resulting in a crash. Chain up to the parent class first in the state change function to make sure streaming has stopped and only then free those buffers. https://bugzilla.gnome.org/show_bug.cgi?id=741381 --- gst/rtp/gstrtph265pay.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/gst/rtp/gstrtph265pay.c b/gst/rtp/gstrtph265pay.c index 0a5bac611f..1ed17f88f2 100644 --- a/gst/rtp/gstrtph265pay.c +++ b/gst/rtp/gstrtph265pay.c @@ -1431,6 +1431,13 @@ gst_rtp_h265_pay_change_state (GstElement * element, GstStateChange transition) rtph265pay->send_vps_sps_pps = FALSE; gst_adapter_clear (rtph265pay->adapter); break; + default: + break; + } + + ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition); + + switch (transition) { case GST_STATE_CHANGE_PAUSED_TO_READY: rtph265pay->last_vps_sps_pps = -1; gst_rtp_h265_pay_clear_vps_sps_pps (rtph265pay); @@ -1439,8 +1446,6 @@ gst_rtp_h265_pay_change_state (GstElement * element, GstStateChange transition) break; } - ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition); - return ret; }