urisourcebin: Fix crash caused by use after free

OutputSlotInfo doesn't hold ref of queue, so gst_bin_remove()
will free the queue memory.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/merge_requests/888>

diff --git a/gst/playback/gsturisourcebin.c b/gst/playback/gsturisourcebin.c
index f5633ba..b8100d2 100644 (file)
--- a/gst/playback/gsturisourcebin.c
+++ b/gst/playback/gsturisourcebin.c
@@ -2008,12 +2008,11 @@ free_output_slot (OutputSlotInfo * slot, GstURISourceBin * urisrc)
 
   gst_element_set_locked_state (slot->queue, TRUE);
   gst_element_set_state (slot->queue, GST_STATE_NULL);
+  remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue));
   gst_bin_remove (GST_BIN_CAST (urisrc), slot->queue);
 
   gst_object_unref (slot->sinkpad);
 
-  remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue));
-
   /* deactivate and remove the srcpad */
   gst_pad_set_active (slot->srcpad, FALSE);
   gst_element_remove_pad (GST_ELEMENT_CAST (urisrc), slot->srcpad);