mirror of
https://gitlab.freedesktop.org/gstreamer/gstreamer.git
synced 2024-12-24 17:20:36 +00:00
91d0a48eea
It is entirely possible for the cancellable to be cancelled (and freed) in gst_rtsp_connection_flush() while there may be an ongoing read/write operation. Nothing prevents gst_rtsp_connection_flush() from waiting for the outstanding read/writes. This could lead to a crash like (where cancellable has been freed within gst_rtsp_connection_flush()): #0 0x00007ffff4351096 in g_output_stream_writev (stream=stream@entry=0x7fff30002950, vectors=vectors@entry=0x7ffe2c6afa80, n_vectors=n_vectors@entry=3, bytes_written=bytes_written@entry=0x7ffe2c6af950, cancellable=cancellable@entry=0x7fff300288a0, error=error@entry=0x7ffe2c6af958) at ../subprojects/glib/gio/goutputstream.c:377 #1 0x00007ffff44b2c38 in writev_bytes (stream=0x7fff30002950, vectors=vectors@entry=0x7ffe2c6afa80, n_vectors=n_vectors@entry=3, bytes_written=bytes_written@entry=0x7ffe2c6afb90, block=block@entry=1, cancellable=0x7fff300288a0) at ../subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c:1320 #2 0x00007ffff44b583e in gst_rtsp_connection_send_messages_usec (conn=0x7fff30001370, messages=messages@entry=0x7ffe2c6afcc0, n_messages=n_messages@entry=1, timeout=timeout@entry=3000000) at ../subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c:2056 #3 0x00007ffff44d2669 in gst_rtsp_client_sink_connection_send_messages (sink=0x7fffac0192c0, timeout=3000000, n_messages=1, messages=0x7ffe2c6afcc0, conninfo=0x7fffac019610) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:1929 #4 gst_rtsp_client_sink_try_send (sink=sink@entry=0x7fffac0192c0, conninfo=conninfo@entry=0x7fffac019610, requests=requests@entry=0x7ffe2c6afcc0, n_requests=n_requests@entry=1, response=response@entry=0x0, code=code@entry=0x0) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:2845 #5 0x00007ffff44d3077 in do_send_data (buffer=0x7fff38075c60, channel=<optimized out>, context=0x7fffac042640) at ../subprojects/gst-rtsp-server/gst/rtsp-sink/gstrtspclientsink.c:3896 #6 0x00007ffff4281cc6 in gst_rtsp_stream_transport_send_rtp (trans=trans@entry=0x7fff20061f80, buffer=<optimized out>) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream-transport.c:632 #7 0x00007ffff4278e9b in push_data (stream=0x7fff40019bf0, is_rtp=<optimized out>, buffer_list=0x0, buffer=<optimized out>, trans=0x7fff20061f80) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2586 #8 check_transport_backlog (stream=0x7fff40019bf0, trans=0x7fff20061f80) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2645 #9 0x00007ffff42793b3 in send_tcp_message (idx=<optimized out>, stream=0x7fff40019bf0) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2741 #10 send_func (stream=0x7fff40019bf0) at ../subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:2776 #11 0x00007ffff7d59fad in g_thread_proxy (data=0x7fffbc062920) at ../subprojects/glib/glib/gthread.c:827 #12 0x00007ffff7a8ce2d in start_thread () from /lib64/libc.so.6 #13 0x00007ffff7b12620 in clone3 () from /lib64/libc.so.6 Fix by adding a cancellable lock and returning an extra reference used across all read/write operations. gst_rtsp_connection_flush() can free the in-use cancellable and it will no longer affect any in progress read/write. Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2816> |
||
---|---|---|
.. | ||
gst-devtools | ||
gst-docs | ||
gst-editing-services | ||
gst-examples | ||
gst-integration-testsuites | ||
gst-libav | ||
gst-omx | ||
gst-plugins-bad | ||
gst-plugins-base | ||
gst-plugins-good | ||
gst-plugins-ugly | ||
gst-python | ||
gst-rtsp-server | ||
gstreamer | ||
gstreamer-sharp | ||
gstreamer-vaapi | ||
macos-bison-binary | ||
packagefiles | ||
win-flex-bison-binaries | ||
win-nasm | ||
avtp.wrap | ||
bindinator.wrap | ||
cairo.wrap | ||
dav1d.wrap | ||
dssim.wrap | ||
dv.wrap | ||
expat.wrap | ||
fdk-aac.wrap | ||
FFmpeg.wrap | ||
fontconfig.wrap | ||
freetype2.wrap | ||
fribidi.wrap | ||
gl-headers.wrap | ||
glib-networking.wrap | ||
glib.wrap | ||
graphene.wrap | ||
gst-plugins-rs.wrap | ||
gtk-sharp.wrap | ||
harfbuzz.wrap | ||
json-glib.wrap | ||
lame.wrap | ||
libdrm.wrap | ||
libffi.wrap | ||
libjpeg-turbo.wrap | ||
libmicrodns.wrap | ||
libnice.wrap | ||
libopenjp2.wrap | ||
libpng.wrap | ||
libpsl.wrap | ||
libsoup.wrap | ||
libwpe.wrap | ||
libxml2.wrap | ||
ogg.wrap | ||
openh264.wrap | ||
opus.wrap | ||
orc.wrap | ||
pango.wrap | ||
pcre.wrap | ||
pixman.wrap | ||
proxy-libintl.wrap | ||
pycairo.wrap | ||
pygobject.wrap | ||
sqlite3.wrap | ||
vorbis.wrap | ||
webrtc-audio-processing.wrap | ||
wpebackend-fdo.wrap | ||
x264.wrap | ||
zlib.wrap |