gstaggregator: fix event use after free

[platform/upstream/gstreamer.git] / libs / gst / base / gstaggregator.c

diff --git a/libs/gst/base/gstaggregator.c b/libs/gst/base/gstaggregator.c
index d458e97..d693541 100644 (file)
--- a/libs/gst/base/gstaggregator.c
+++ b/libs/gst/base/gstaggregator.c
@@ -2310,10 +2310,11 @@ flushing:
   return FALSE;
 }
 
-static gboolean
+static GstFlowReturn
 gst_aggregator_pad_event_func (GstPad * pad, GstObject * parent,
     GstEvent * event)
 {
+  GstFlowReturn ret = GST_FLOW_OK;
   GstAggregator *self = GST_AGGREGATOR (parent);
   GstAggregatorPad *aggpad = GST_AGGREGATOR_PAD (pad);
   GstAggregatorClass *klass = GST_AGGREGATOR_GET_CLASS (parent);
@@ -2324,8 +2325,10 @@ gst_aggregator_pad_event_func (GstPad * pad, GstObject * parent,
     PAD_LOCK (aggpad);
 
     if (aggpad->priv->flow_return != GST_FLOW_OK
-        && GST_EVENT_TYPE (event) != GST_EVENT_FLUSH_STOP)
+        && GST_EVENT_TYPE (event) != GST_EVENT_FLUSH_STOP) {
+      ret = aggpad->priv->flow_return;
       goto flushing;
+    }
 
     if (GST_EVENT_TYPE (event) == GST_EVENT_SEGMENT) {
       GST_OBJECT_LOCK (aggpad);
@@ -2347,10 +2350,17 @@ gst_aggregator_pad_event_func (GstPad * pad, GstObject * parent,
     SRC_UNLOCK (self);
   }
 
-  if (event)
-    return klass->sink_event (self, aggpad, event);
-  else
-    return TRUE;
+  if (event) {
+    gboolean is_caps = (GST_EVENT_TYPE (event) == GST_EVENT_CAPS);
+
+    if (!klass->sink_event (self, aggpad, event)) {
+      /* Copied from GstPad to convert boolean to a GstFlowReturn in
+       * the event handling func */
+      ret = is_caps ? GST_FLOW_NOT_NEGOTIATED : GST_FLOW_ERROR;
+    }
+  }
+
+  return ret;
 
 flushing:
   GST_DEBUG_OBJECT (aggpad, "Pad is %s, dropping event",
@@ -2360,7 +2370,8 @@ flushing:
   if (GST_EVENT_IS_STICKY (event))
     gst_pad_store_sticky_event (pad, event);
   gst_event_unref (event);
-  return FALSE;
+
+  return ret;
 }
 
 static gboolean
@@ -2397,8 +2408,9 @@ gst_aggregator_pad_constructed (GObject * object)
 
   gst_pad_set_chain_function (pad,
       GST_DEBUG_FUNCPTR (gst_aggregator_pad_chain));
-  gst_pad_set_event_function (pad,
-      GST_DEBUG_FUNCPTR (gst_aggregator_pad_event_func));
+  gst_pad_set_event_full_function_full (pad,
+      GST_DEBUG_FUNCPTR (gst_aggregator_pad_event_func),
+      NULL, NULL);
   gst_pad_set_query_function (pad,
       GST_DEBUG_FUNCPTR (gst_aggregator_pad_query_func));
   gst_pad_set_activatemode_function (pad,