v4l2src: Fix crash in renegotiation

This regression was introduce by fix for making buffer pool thread safe. When
we renegotiate, the pool will be setup after we set the format. But the code
has been simplified to only get the pool once before, which caused a null
pointer deref.

Fixes 94ba019 ("v4l2: Fix SIGSEGV on 'change state' during 'format change'")
Related to !3481
Fixes #1626

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/3513>

1 files changed, 6 insertions, 1 deletions

diff --git a/subprojects/gst-plugins-good/sys/v4l2/gstv4l2src.c b/subprojects/gst-plugins-good/sys/v4l2/gstv4l2src.c
index eebca69873..e33b71ec3c 100644
--- a/subprojects/gst-plugins-good/sys/v4l2/gstv4l2src.c
+++ b/subprojects/gst-plugins-good/sys/v4l2/gstv4l2src.c
@@ -907,11 +907,16 @@ gst_v4l2src_decide_allocation (GstBaseSrc * bsrc, GstQuery * query)
     GstCaps *caps = gst_pad_get_current_caps (GST_BASE_SRC_PAD (bsrc));
     GstV4l2Error error = GST_V4L2_ERROR_INIT;
 
+    /* Setting the format replaces the current pool */
+    gst_clear_object (&bpool);
+
     caps = gst_caps_make_writable (caps);
 
     ret = gst_v4l2src_set_format (src, caps, &error);
     if (ret) {
-      GstV4l2BufferPool *pool = GST_V4L2_BUFFER_POOL (bpool);
+      GstV4l2BufferPool *pool;
+      bpool = gst_v4l2_object_get_buffer_pool (src->v4l2object);
+      pool = GST_V4L2_BUFFER_POOL (bpool);
       gst_v4l2_buffer_pool_enable_resolution_change (pool);
     } else {
       gst_v4l2_error (src, &error);