adaptivedemux2: Fix memory leaks and use-after-free

Fix various small memory leaks, and an invalid
access to GstEvent after giving away the ref
via gst_pad_push_event()

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2676>

diff --git a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c
index 3e109f1..2e977dc 100644 (file)
--- a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c
+++ b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemux.c
@@ -1163,6 +1163,9 @@ gst_adaptive_demux_handle_upstream_http_header (GQuark field_id,
         g_free (date_string);
 
         gst_adaptive_demux_clock_set_utc_time (demux->realtime_clock, utc_now);
+
+        g_date_time_unref (utc_now);
+        gst_date_time_unref (datetime);
       }
     }
   }
@@ -3669,10 +3672,11 @@ restart:
         GstEvent *event = (GstEvent *) mo;
         if (GST_EVENT_TYPE (event) == GST_EVENT_GAP)
           slot->pushed_timed_data = TRUE;
-        gst_pad_push_event (slot->pad, event);
+        gst_pad_push_event (slot->pad, gst_event_ref (event));
 
         if (GST_EVENT_IS_STICKY (event))
           gst_event_store_mark_delivered (&track->sticky_events, event);
+        gst_event_unref (event);
       } else if (GST_IS_BUFFER (mo)) {
         GstBuffer *buffer = (GstBuffer *) mo;
 

diff --git a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c
index c0cd9a3..994a94b 100644 (file)
--- a/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c
+++ b/subprojects/gst-plugins-good/ext/adaptivedemux2/gstadaptivedemuxutils.c
@@ -229,7 +229,7 @@ void
 gst_adaptive_demux_loop_start (GstAdaptiveDemuxLoop * loop)
 {
   g_mutex_lock (&loop->lock);
-  if (loop->thread != NULL && !loop->stopped)
+  if (loop->thread != NULL)
     goto done;                  /* Already running */
 
   loop->stopped = FALSE;
@@ -255,9 +255,10 @@ void
 gst_adaptive_demux_loop_stop (GstAdaptiveDemuxLoop * loop, gboolean wait)
 {
   g_mutex_lock (&loop->lock);
-  loop->stopped = TRUE;
 
-  if (loop->loop != NULL) {
+  if (!loop->stopped) {
+    loop->stopped = TRUE;
+
     GSource *s = g_idle_source_new ();
     g_source_set_callback (s, (GSourceFunc) do_quit_cb,
         gst_adaptive_demux_loop_ref (loop),
@@ -269,6 +270,11 @@ gst_adaptive_demux_loop_stop (GstAdaptiveDemuxLoop * loop, gboolean wait)
       while (loop->loop != NULL)
         g_cond_wait (&loop->cond, &loop->lock);
     }
+
+    if (loop->thread != NULL) {
+      g_thread_unref (loop->thread);
+      loop->thread = NULL;
+    }
   }
 
   g_mutex_unlock (&loop->lock);