rtph264pay: fix potential crash when shutting down

A race condition in the state change function may cause buffers
to be unreffed while they are still used by the streaming thread
in gst_rtp_h264_pay_send_sps_pps() resulting in a crash. Chain
up to the parent class first in the state change function to
make sure streaming has stopped and only then free those buffers.

https://bugzilla.gnome.org/show_bug.cgi?id=741381

diff --git a/gst/rtp/gstrtph264pay.c b/gst/rtp/gstrtph264pay.c
index 8590d99..ba5e4b3 100644 (file)
--- a/gst/rtp/gstrtph264pay.c
+++ b/gst/rtp/gstrtph264pay.c
@@ -1336,6 +1336,13 @@ gst_rtp_h264_pay_change_state (GstElement * element, GstStateChange transition)
       rtph264pay->send_spspps = FALSE;
       gst_adapter_clear (rtph264pay->adapter);
       break;
+    default:
+      break;
+  }
+
+  ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition);
+
+  switch (transition) {
     case GST_STATE_CHANGE_PAUSED_TO_READY:
       rtph264pay->last_spspps = -1;
       gst_rtp_h264_pay_clear_sps_pps (rtph264pay);
@@ -1344,8 +1351,6 @@ gst_rtp_h264_pay_change_state (GstElement * element, GstStateChange transition)
       break;
   }
 
-  ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition);
-
   return ret;
 }