fixup! webrtc_private: Check and release remaining transceivers when destroying handle

The logic is moved to _source_slot_destroy_cb() in webrtc_source.c.
NULL source type is excluded to apply these unreffing codes to avoid
'head-use-after-free' issue on ASAN test when webrtc_destroy().

[Version] 1.1.38
[Issue Type] Bug fix

Change-Id: I6d2d8b7bcd80631c13ca952c570c057f0dbe8534
Signed-off-by: Sangchul Lee <sc11.lee@samsung.com>

diff --git a/packaging/capi-media-webrtc.spec b/packaging/capi-media-webrtc.spec
index 94784241c05ff06850afbf2153076ea73348146a..39bbf881c4bd43ea8e73afd4f79b19171183170d 100644 (file)
--- a/packaging/capi-media-webrtc.spec
+++ b/packaging/capi-media-webrtc.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-webrtc
 Summary:    A WebRTC library in Tizen Native API
-Version:    1.1.37
+Version:    1.1.38
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/webrtc_private.c b/src/webrtc_private.c
index 119e56434630a277f93a4f8d11332a7d8d9b28d0..a879569951308b360d7b333410efe8d3b27b7a10 100644 (file)
--- a/src/webrtc_private.c
+++ b/src/webrtc_private.c
@@ -1652,23 +1652,6 @@ static void __destroy_source_pipeline(webrtc_s *webrtc)
        }
 }
 
-static void __release_all_remaining_transceivers(webrtc_s *webrtc)
-{
-       GArray *trans_array;
-       int i;
-
-       ASSERT(webrtc);
-
-       g_signal_emit_by_name(webrtc->gst.webrtcbin, "get-transceivers", &trans_array, NULL);
-       for (i = 0; i < (int)trans_array->len; i++) {
-               GstWebRTCRTPTransceiver *trans = g_array_index(trans_array, GstWebRTCRTPTransceiver*, i);
-               LOG_DEBUG("unreferencing transceiver[%p]", trans);
-               gst_object_unref(trans); /* unreferencing it due to the increased referencing value by calling get-transceivers() */
-               gst_object_unref(trans); /* unreferencing it once again to demand to release this object */
-       }
-       g_array_unref(trans_array);
-}
-
 void _gst_destroy_pipeline(webrtc_s *webrtc)
 {
        RET_IF(webrtc == NULL, "webrtc is NULL");
@@ -1684,8 +1667,6 @@ void _gst_destroy_pipeline(webrtc_s *webrtc)
                webrtc->sources = NULL;
        }
 
-       __release_all_remaining_transceivers(webrtc);
-
        if (webrtc->gst.bus_watcher > 0) {
                gst_bus_remove_watch(webrtc->gst.bus);
                webrtc->gst.bus_watcher = 0;

diff --git a/src/webrtc_source.c b/src/webrtc_source.c
index 7cdf24ff21c7817144fcd1238c8373ce4536921e..3139a426136e91a53876b6312b777c30221a33e5 100644 (file)
--- a/src/webrtc_source.c
+++ b/src/webrtc_source.c
@@ -691,6 +691,13 @@ void _source_slot_destroy_cb(gpointer data)
 
                if (source->av[i].transceiver) {
                        gst_object_unref(source->av[i].transceiver);
+                       /* unreferencing it twice again all the other cases except for null source type, *
+                        * because requesting pad to gstwebrtcbin of these cases refers the object two *
+                        * times more internally than a case of using 'add-transceiver' signal function. */
+                       if (source->type != WEBRTC_MEDIA_SOURCE_TYPE_NULL) {
+                               gst_object_unref(source->av[i].transceiver);
+                               gst_object_unref(source->av[i].transceiver);
+                       }
                        g_hash_table_remove(source->webrtc->sources, source->av[i].transceiver);
                }
                g_free(source->av[i].mid);