rtsp-media: Take reference to media that will be prepared

default_prepare() takes a transfer-none reference GstRTSPMedia object.
Later on a g_idle_source_new() is created and a pointer to the media
object is passed as user data. If the media is freed before the idle
source is dispatched the media object pointer is invalid, but the idle
source callback expects it to still be valid. To fix this a reference to
the media object is taken when registering the source callback function
and a corresponding release of the reference is done when the souce is
destroyed.

Fixes https://bugzilla.gnome.org/show_bug.cgi?id=755748

diff --git a/gst/rtsp-server/rtsp-media.c b/gst/rtsp-server/rtsp-media.c
index adccff9..5a6f758 100644 (file)
--- a/gst/rtsp-server/rtsp-media.c
+++ b/gst/rtsp-server/rtsp-media.c
@@ -2603,7 +2603,8 @@ default_prepare (GstRTSPMedia * media, GstRTSPThread * thread)
 
   /* do remainder in context */
   source = g_idle_source_new ();
-  g_source_set_callback (source, (GSourceFunc) start_prepare, media, NULL);
+  g_source_set_callback (source, (GSourceFunc) start_prepare,
+    g_object_ref (media), (GDestroyNotify) g_object_unref);
   g_source_attach (source, context);
   g_source_unref (source);