fixup! webrtc_private: Check and release remaining transceivers when destroying handle

The logic is moved to _source_slot_destroy_cb() in webrtc_source.c.
NULL source type is excluded to apply these unreffing codes to avoid
'head-use-after-free' issue on ASAN test when webrtc_destroy().

[Version] 0.4.70
[Issue Type] Bug fix

Change-Id: I6d2d8b7bcd80631c13ca952c570c057f0dbe8534
Signed-off-by: Sangchul Lee <sc11.lee@samsung.com>

diff --git a/packaging/capi-media-webrtc.spec b/packaging/capi-media-webrtc.spec
index b241753715f2051049fee4764076fa05602b8239..9394ed7ec7588288901af8497634a13ae10701e8 100644 (file)
--- a/packaging/capi-media-webrtc.spec
+++ b/packaging/capi-media-webrtc.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-webrtc
 Summary:    A WebRTC library in Tizen Native API
-Version:    0.4.69
+Version:    0.4.70
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/webrtc_private.c b/src/webrtc_private.c
index 816d6eb0bdfbffacd3a252f5b9b9bd7aeb845789..c5806c2cded46ab572719a87af963c679177a8ea 100644 (file)
--- a/src/webrtc_private.c
+++ b/src/webrtc_private.c
@@ -1650,23 +1650,6 @@ static void __destroy_source_pipeline(webrtc_s *webrtc)
        }
 }
 
-static void __release_all_remaining_transceivers(webrtc_s *webrtc)
-{
-       GArray *trans_array;
-       int i;
-
-       ASSERT(webrtc);
-
-       g_signal_emit_by_name(webrtc->gst.webrtcbin, "get-transceivers", &trans_array, NULL);
-       for (i = 0; i < (int)trans_array->len; i++) {
-               GstWebRTCRTPTransceiver *trans = g_array_index(trans_array, GstWebRTCRTPTransceiver*, i);
-               LOG_DEBUG("unreferencing transceiver[%p]", trans);
-               gst_object_unref(trans); /* unreferencing it due to the increased referencing value by calling get-transceivers() */
-               gst_object_unref(trans); /* unreferencing it once again to demand to release this object */
-       }
-       g_array_unref(trans_array);
-}
-
 void _gst_destroy_pipeline(webrtc_s *webrtc)
 {
        RET_IF(webrtc == NULL, "webrtc is NULL");
@@ -1682,8 +1665,6 @@ void _gst_destroy_pipeline(webrtc_s *webrtc)
                webrtc->sources = NULL;
        }
 
-       __release_all_remaining_transceivers(webrtc);
-
        if (webrtc->gst.bus_watcher > 0) {
                gst_bus_remove_watch(webrtc->gst.bus);
                webrtc->gst.bus_watcher = 0;

diff --git a/src/webrtc_source.c b/src/webrtc_source.c
index 06055da8eb21b188eafb3acb1382ba8adc384909..dcd4e38fece762d9b6ff141633fdb2d95b82f2d8 100644 (file)
--- a/src/webrtc_source.c
+++ b/src/webrtc_source.c
@@ -594,6 +594,13 @@ void _source_slot_destroy_cb(gpointer data)
 
                if (source->av[i].transceiver) {
                        gst_object_unref(source->av[i].transceiver);
+                       /* unreferencing it twice again all the other cases except for null source type, *
+                        * because requesting pad to gstwebrtcbin of these cases refers the object two *
+                        * times more internally than a case of using 'add-transceiver' signal function. */
+                       if (source->type != WEBRTC_MEDIA_SOURCE_TYPE_NULL) {
+                               gst_object_unref(source->av[i].transceiver);
+                               gst_object_unref(source->av[i].transceiver);
+                       }
                        g_hash_table_remove(source->webrtc->sources, source->av[i].transceiver);
                }
                g_free(source->av[i].mid);