From: Sangchul Lee <sc11.lee@samsung.com>
Date: Mon, 21 Oct 2024 06:21:53 +0000 (+0900)
Subject: fixup! webrtc_private: Check and release remaining transceivers when destroying handle
X-Git-Tag: accepted/tizen/8.0/unified/20241030.154748~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=092abacd9b32831ffcefe94df7a98417e9f32c1a;p=platform%2Fcore%2Fapi%2Fwebrtc.git

fixup! webrtc_private: Check and release remaining transceivers when destroying handle

The logic is moved to _source_slot_destroy_cb() in webrtc_source.c.
NULL source type is excluded to apply these unreffing codes to avoid
'head-use-after-free' issue on ASAN test when webrtc_destroy().

[Version] 0.4.70
[Issue Type] Bug fix

Change-Id: I6d2d8b7bcd80631c13ca952c570c057f0dbe8534
Signed-off-by: Sangchul Lee <sc11.lee@samsung.com>
---

diff --git a/packaging/capi-media-webrtc.spec b/packaging/capi-media-webrtc.spec
index b2417537..9394ed7e 100644
--- a/packaging/capi-media-webrtc.spec
+++ b/packaging/capi-media-webrtc.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-webrtc
 Summary:    A WebRTC library in Tizen Native API
-Version:    0.4.69
+Version:    0.4.70
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0
diff --git a/src/webrtc_private.c b/src/webrtc_private.c
index 816d6eb0..c5806c2c 100644
--- a/src/webrtc_private.c
+++ b/src/webrtc_private.c
@@ -1650,23 +1650,6 @@ static void __destroy_source_pipeline(webrtc_s *webrtc)
 	}
 }
 
-static void __release_all_remaining_transceivers(webrtc_s *webrtc)
-{
-	GArray *trans_array;
-	int i;
-
-	ASSERT(webrtc);
-
-	g_signal_emit_by_name(webrtc->gst.webrtcbin, "get-transceivers", &trans_array, NULL);
-	for (i = 0; i < (int)trans_array->len; i++) {
-		GstWebRTCRTPTransceiver *trans = g_array_index(trans_array, GstWebRTCRTPTransceiver*, i);
-		LOG_DEBUG("unreferencing transceiver[%p]", trans);
-		gst_object_unref(trans); /* unreferencing it due to the increased referencing value by calling get-transceivers() */
-		gst_object_unref(trans); /* unreferencing it once again to demand to release this object */
-	}
-	g_array_unref(trans_array);
-}
-
 void _gst_destroy_pipeline(webrtc_s *webrtc)
 {
 	RET_IF(webrtc == NULL, "webrtc is NULL");
@@ -1682,8 +1665,6 @@ void _gst_destroy_pipeline(webrtc_s *webrtc)
 		webrtc->sources = NULL;
 	}
 
-	__release_all_remaining_transceivers(webrtc);
-
 	if (webrtc->gst.bus_watcher > 0) {
 		gst_bus_remove_watch(webrtc->gst.bus);
 		webrtc->gst.bus_watcher = 0;
diff --git a/src/webrtc_source.c b/src/webrtc_source.c
index 06055da8..dcd4e38f 100644
--- a/src/webrtc_source.c
+++ b/src/webrtc_source.c
@@ -594,6 +594,13 @@ void _source_slot_destroy_cb(gpointer data)
 
 		if (source->av[i].transceiver) {
 			gst_object_unref(source->av[i].transceiver);
+			/* unreferencing it twice again all the other cases except for null source type, *
+			 * because requesting pad to gstwebrtcbin of these cases refers the object two *
+			 * times more internally than a case of using 'add-transceiver' signal function. */
+			if (source->type != WEBRTC_MEDIA_SOURCE_TYPE_NULL) {
+				gst_object_unref(source->av[i].transceiver);
+				gst_object_unref(source->av[i].transceiver);
+			}
 			g_hash_table_remove(source->webrtc->sources, source->av[i].transceiver);
 		}
 		g_free(source->av[i].mid);