mirror of
https://gitlab.freedesktop.org/gstreamer/gstreamer.git
synced 2024-10-02 16:52:42 +00:00
598f2ab73f
It is entirely possible for the cancellable to be cancelled (and freed) in gst_rtsp_connection_flush() while there may be an ongoing read/write operation. Nothing prevents gst_rtsp_connection_flush() from waiting for the outstanding read/writes. This could lead to a crash like (where cancellable has been freed within gst_rtsp_connection_flush()): #0 0x00007ffff4351096 in g_output_stream_writev (stream=stream@entry=0x7fff30002950, vectors=vectors@entry=0x7ffe2c6afa80, n_vectors=n_vectors@entry=3, bytes_written=bytes_written@entry=0x7ffe2c6af950, cancellable=cancellable@entry=0x7fff300288a0, error=error@entry=0x7ffe2c6af958) at ../subprojects/glib/gio/goutputstream.c:377 #1 0x00007ffff44b2c38 in writev_bytes (stream=0x7fff30002950, vectors=vectors@entry=0x7ffe2c6afa80, n_vectors=n_vectors@entry=3, bytes_written=bytes_written@entry=0x7ffe2c6afb90, block=block@entry=1, cancellable=0x7fff300288a0) at ../subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c:1320 #2 0x00007ffff44b583e in gst_rtsp_connection_send_messages_usec (conn=0x7fff30001370, messages=messages@entry=0x7ffe2c6afcc0, n_messages=n_messages@entry=1, timeout=timeout@entry=3000000) at ../subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c:2056 #3 0x00007ffff44d2669 in gst_rtsp_client_sink_connection_send_messages (sink=0x7fffac0192c0, timeout=3000000, n_messages=1, messages=0x7ffe2c6afcc0, conninfo=0x7fffac019610) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:1929 #4 gst_rtsp_client_sink_try_send (sink=sink@entry=0x7fffac0192c0, conninfo=conninfo@entry=0x7fffac019610, requests=requests@entry=0x7ffe2c6afcc0, n_requests=n_requests@entry=1, response=response@entry=0x0, code=code@entry=0x0) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:2845 #5 0x00007ffff44d3077 in do_send_data (buffer=0x7fff38075c60, channel=<optimized out>, context=0x7fffac042640) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:3896 #6 0x00007ffff4281cc6 in gst_rtsp_stream_transport_send_rtp (trans=trans@entry=0x7fff20061f80, buffer=<optimized out>) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream-transport.c:632 #7 0x00007ffff4278e9b in push_data (stream=0x7fff40019bf0, is_rtp=<optimized out>, buffer_list=0x0, buffer=<optimized out>, trans=0x7fff20061f80) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2586 #8 check_transport_backlog (stream=0x7fff40019bf0, trans=0x7fff20061f80) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2645 #9 0x00007ffff42793b3 in send_tcp_message (idx=<optimized out>, stream=0x7fff40019bf0) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2741 #10 send_func (stream=0x7fff40019bf0) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2776 #11 0x00007ffff7d59fad in g_thread_proxy (data=0x7fffbc062920) at ../subprojects/glib/glib/gthread.c:827 #12 0x00007ffff7a8ce2d in start_thread () from /lib64/libc.so.6 #13 0x00007ffff7b12620 in clone3 () from /lib64/libc.so.6 Fix by adding a cancellable lock and returning an extra reference used across all read/write operations. gst_rtsp_connection_flush() can free the in-use cancellable and it will no longer affect any in progress read/write. Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2799> |
||
|---|---|---|
| .. | ||
| gst-devtools | ||
| gst-docs | ||
| gst-editing-services | ||
| gst-examples | ||
| gst-integration-testsuites | ||
| gst-libav | ||
| gst-omx | ||
| gst-plugins-bad | ||
| gst-plugins-base | ||
| gst-plugins-good | ||
| gst-plugins-ugly | ||
| gst-python | ||
| gst-rtsp-server | ||
| gstreamer | ||
| gstreamer-sharp | ||
| gstreamer-vaapi | ||
| macos-bison-binary | ||
| packagefiles | ||
| win-flex-bison-binaries | ||
| win-nasm | ||
| avtp.wrap | ||
| bindinator.wrap | ||
| cairo.wrap | ||
| dav1d.wrap | ||
| dssim.wrap | ||
| dv.wrap | ||
| expat.wrap | ||
| fdk-aac.wrap | ||
| FFmpeg.wrap | ||
| fontconfig.wrap | ||
| freetype2.wrap | ||
| fribidi.wrap | ||
| gl-headers.wrap | ||
| glib-networking.wrap | ||
| glib.wrap | ||
| graphene.wrap | ||
| gst-plugins-rs.wrap | ||
| gtk-sharp.wrap | ||
| harfbuzz.wrap | ||
| json-glib.wrap | ||
| lame.wrap | ||
| libdrm.wrap | ||
| libffi.wrap | ||
| libjpeg-turbo.wrap | ||
| libmicrodns.wrap | ||
| libnice.wrap | ||
| libopenjp2.wrap | ||
| libpng.wrap | ||
| libpsl.wrap | ||
| libsoup.wrap | ||
| libwpe.wrap | ||
| libxml2.wrap | ||
| ogg.wrap | ||
| openh264.wrap | ||
| opus.wrap | ||
| orc.wrap | ||
| pango.wrap | ||
| pixman.wrap | ||
| proxy-libintl.wrap | ||
| pycairo.wrap | ||
| pygobject.wrap | ||
| sqlite3.wrap | ||
| vorbis.wrap | ||
| webrtc-audio-processing.wrap | ||
| wpebackend-fdo.wrap | ||
| x264.wrap | ||
| zlib.wrap | ||