hlsdemux: Don't double-free variant streams on errors

If an error happened switching to a new variant, we switch back to the previous
one ... except it will be unreffed when settin git.

In order to avoid such issues, keep a reference to the old variant until we're
sure we don't need it anymore

Fixes cases of double-free on variants and its contents

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1817>

1 files changed, 4 insertions, 1 deletions

diff --git a/ext/hls/gsthlsdemux.c b/ext/hls/gsthlsdemux.c
index 6b9c7836c..50da34d57 100644
--- a/ext/hls/gsthlsdemux.c
+++ b/ext/hls/gsthlsdemux.c
@@ -1598,7 +1598,8 @@ gst_hls_demux_change_playlist (GstHLSDemux * demux, guint max_bitrate,
 
   stream = adaptive_demux->streams->data;
 
-  previous_variant = demux->current_variant;
+  /* Make sure we keep a reference in case we need to switch back */
+  previous_variant = gst_hls_variant_stream_ref (demux->current_variant);
   new_variant =
       gst_hls_master_playlist_get_variant_for_bitrate (demux->master,
       demux->current_variant, max_bitrate);
@@ -1612,6 +1613,7 @@ retry_failover_protection:
   /* Don't do anything else if the playlist is the same */
   if (new_bandwidth == old_bandwidth) {
     GST_M3U8_CLIENT_UNLOCK (demux->client);
+    gst_hls_variant_stream_unref (previous_variant);
     return TRUE;
   }
 
@@ -1673,6 +1675,7 @@ retry_failover_protection:
     return gst_hls_demux_change_playlist (demux, new_bandwidth - 1, changed);
   }
 
+  gst_hls_variant_stream_unref (previous_variant);
   return TRUE;
 }