mpegtsmux: crashes when trying to re-use the element

A crash occured after pushing buffers and changing mpegtsmux state to
NULL/READ and then back to PLAYING/PAUSED.

The crash was caused by holding a dangling pointer in the MpegTsMux
program table.

Additionally stream headers were leaked when resetting the element:
mux->streamheader set to NULL in mpegtsmux_reset() before it's released
later in the same function.

Added a unit test: test_multiple_state_change

https://bugzilla.gnome.org/show_bug.cgi?id=689107

2 files changed, 54 insertions, 1 deletions

diff --git a/gst/mpegtsmux/mpegtsmux.c b/gst/mpegtsmux/mpegtsmux.c
index 13d4946e3..017e54a34 100644
--- a/gst/mpegtsmux/mpegtsmux.c
+++ b/gst/mpegtsmux/mpegtsmux.c
@@ -354,7 +354,6 @@ mpegtsmux_reset (MpegTsMux * mux, gboolean alloc)
   mux->last_ts = 0;
   mux->is_delta = TRUE;
 
-  mux->streamheader = NULL;
   mux->streamheader_sent = FALSE;
   mux->force_key_unit_event = NULL;
   mux->pending_key_unit_ts = GST_CLOCK_TIME_NONE;
@@ -374,6 +373,8 @@ mpegtsmux_reset (MpegTsMux * mux, gboolean alloc)
     mux->tsmux = NULL;
   }
 
+  memset (mux->programs, 0, sizeof (mux->programs));
+
   if (mux->streamheader) {
     GstBuffer *buf;
     GList *sh;
diff --git a/tests/check/elements/mpegtsmux.c b/tests/check/elements/mpegtsmux.c
index d3ba07fb9..76d3e4eaf 100644
--- a/tests/check/elements/mpegtsmux.c
+++ b/tests/check/elements/mpegtsmux.c
@@ -676,6 +676,57 @@ GST_START_TEST (test_propagate_flow_status)
 
 GST_END_TEST;
 
+GST_START_TEST (test_multiple_state_change)
+{
+  GstElement *mux;
+  gchar *padname;
+  GstSegment segment;
+  GstCaps *caps;
+  size_t i;
+
+  /* it's just a sample of all possible permutations of all states and their
+   * transitions */
+  GstState states[] = { GST_STATE_PLAYING, GST_STATE_PAUSED, GST_STATE_PLAYING,
+    GST_STATE_READY, GST_STATE_PAUSED, GST_STATE_PLAYING, GST_STATE_NULL
+  };
+
+  size_t num_transitions_to_test = 10;
+
+  mux = setup_tsmux (&video_src_template, "sink_%d", &padname);
+  gst_pad_set_chain_function (mysinkpad, flow_test_stat_chain_func);
+  gst_segment_init (&segment, GST_FORMAT_TIME);
+
+  caps = gst_caps_from_string (VIDEO_CAPS_STRING);
+  gst_pad_set_caps (mysrcpad, caps);
+  gst_caps_unref (caps);
+
+  for (i = 0; i < num_transitions_to_test; ++i) {
+    GstState next_state = states[i % G_N_ELEMENTS (states)];
+    fail_unless (gst_element_set_state (mux,
+            next_state) == GST_STATE_CHANGE_SUCCESS,
+        "could not set to %s", gst_element_state_get_name (next_state));
+
+    /* push some buffers when playing - this triggers a lot of activity */
+    if (GST_STATE_PLAYING == next_state) {
+      GstBuffer *inbuffer;
+
+      fail_unless (gst_pad_push_event (mysrcpad,
+              gst_event_new_segment (&segment)));
+
+      inbuffer = gst_buffer_new_and_alloc (1);
+      ASSERT_BUFFER_REFCOUNT (inbuffer, "inbuffer", 1);
+
+      GST_BUFFER_TIMESTAMP (inbuffer) = GST_FLOW_OK;
+      fail_unless (GST_FLOW_OK == gst_pad_push (mysrcpad, inbuffer));
+    }
+  }
+
+  cleanup_tsmux (mux, padname);
+  g_free (padname);
+}
+
+GST_END_TEST;
+
 static Suite *
 mpegtsmux_suite (void)
 {
@@ -689,6 +740,7 @@ mpegtsmux_suite (void)
   tcase_add_test (tc_chain, test_force_key_unit_event_downstream);
   tcase_add_test (tc_chain, test_force_key_unit_event_upstream);
   tcase_add_test (tc_chain, test_propagate_flow_status);
+  tcase_add_test (tc_chain, test_multiple_state_change);
 
   return s;
 }