sdpdemux: ensure that only one srcpad is created per stream

If two senders use the same multicast IP and port then new_session_pad()
may try to add a srcpad to the same stream twice.

stream->srcpad is updated but gst_element_add_pad() fails the second
time. As a result stream->srcpad points to a deleted object and
access in gst_sdp_demux_stream_free() fails with a segfault.

Just ignore the second pad. Nothing useful can be done with it anyway.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4873>

diff --git a/subprojects/gst-plugins-bad/gst/sdp/gstsdpdemux.c b/subprojects/gst-plugins-bad/gst/sdp/gstsdpdemux.c
index a97dd54..cc5baa6 100644 (file)
--- a/subprojects/gst-plugins-bad/gst/sdp/gstsdpdemux.c
+++ b/subprojects/gst-plugins-bad/gst/sdp/gstsdpdemux.c
@@ -536,6 +536,9 @@ new_session_pad (GstElement * session, GstPad * pad, GstSDPDemux * demux)
   if (stream == NULL)
     goto unknown_stream;
 
+  if (stream->srcpad)
+    goto unexpected_pad;
+
   stream->ssrc = ssrc;
 
   /* no need for a timeout anymore now */
@@ -576,6 +579,13 @@ new_session_pad (GstElement * session, GstPad * pad, GstSDPDemux * demux)
   return;
 
   /* ERRORS */
+unexpected_pad:
+  {
+    GST_DEBUG_OBJECT (demux, "ignoring unexpected session pad");
+    GST_SDP_STREAM_UNLOCK (demux);
+    g_free (name);
+    return;
+  }
 unknown_stream:
   {
     GST_DEBUG_OBJECT (demux, "ignoring unknown stream");