diff options
| author | Seungha Yang <seungha@centricular.com> | 2020-10-22 19:16:42 +0900 |
|---|---|---|
| committer | GStreamer Merge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2020-10-22 19:47:35 +0000 |
| commit | 18960a397f4e1b397e4ba66f6ea00180deb7ad4a (patch) | |
| tree | 59cde6552ad0f4b7ea01187e66dae634b867c8a9 | |
| parent | 7a9238cf71f28668dd759ca2bf19c8a28a781649 (diff) | |
| download | gstreamer-plugins-base-18960a397f4e1b397e4ba66f6ea00180deb7ad4a.tar.gz | |
urisourcebin: Fix crash caused by use after free
OutputSlotInfo doesn't hold ref of queue, so gst_bin_remove()
will free the queue memory.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/merge_requests/890>
| -rw-r--r-- | gst/playback/gsturisourcebin.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/gst/playback/gsturisourcebin.c b/gst/playback/gsturisourcebin.c index f5633ba51..b8100d233 100644 --- a/gst/playback/gsturisourcebin.c +++ b/gst/playback/gsturisourcebin.c @@ -2008,12 +2008,11 @@ free_output_slot (OutputSlotInfo * slot, GstURISourceBin * urisrc) gst_element_set_locked_state (slot->queue, TRUE); gst_element_set_state (slot->queue, GST_STATE_NULL); + remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue)); gst_bin_remove (GST_BIN_CAST (urisrc), slot->queue); gst_object_unref (slot->sinkpad); - remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue)); - /* deactivate and remove the srcpad */ gst_pad_set_active (slot->srcpad, FALSE); gst_element_remove_pad (GST_ELEMENT_CAST (urisrc), slot->srcpad); |