From: Jan Schmidt <jan@centricular.com>
Date: Tue, 27 Oct 2020 12:43:49 +0000 (+1100)
Subject: matroska-mux: Fix sparse stream crash
X-Git-Tag: 1.19.3~509^2~374
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=0e84f42055d7a40f2b8a94224894d8d429ce2f12;p=platform%2Fupstream%2Fgstreamer.git

matroska-mux: Fix sparse stream crash

https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/656
introduced an invalid memory access when debug is enabled, by casting
the wrong pointer to a GstCollectPad. Fixing that showed the original
change was incorrect and leads to an infinite loop in the
testsuite. This patch fixes both problems.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/788>
---

diff --git a/gst/matroska/matroska-mux.c b/gst/matroska/matroska-mux.c
index 85cb1f2..3cb9bae 100644
--- a/gst/matroska/matroska-mux.c
+++ b/gst/matroska/matroska-mux.c
@@ -2255,8 +2255,6 @@ refuse_caps:
 static gboolean
 gst_matroska_mux_subtitle_pad_setcaps (GstPad * pad, GstCaps * caps)
 {
-  GstCollectData *data = (GstCollectData *) (pad);
-
   /* There is now (at least) one such alement (kateenc), and I'm going
      to handle it here and claim it works when it can be piped back
      through GStreamer and VLC */
@@ -2265,6 +2263,7 @@ gst_matroska_mux_subtitle_pad_setcaps (GstPad * pad, GstCaps * caps)
   GstMatroskaTrackSubtitleContext *scontext;
   GstMatroskaMux *mux;
   GstMatroskaPad *collect_pad;
+  GstCollectData *data;
   const gchar *mimetype;
   GstStructure *structure;
   const GValue *value = NULL;
@@ -2293,6 +2292,8 @@ gst_matroska_mux_subtitle_pad_setcaps (GstPad * pad, GstCaps * caps)
   /* find context */
   collect_pad = (GstMatroskaPad *) gst_pad_get_element_private (pad);
   g_assert (collect_pad);
+  data = (GstCollectData *) (collect_pad);
+
   context = collect_pad->track;
   g_assert (context);
   g_assert (context->type == GST_MATROSKA_TRACK_TYPE_SUBTITLE);
@@ -2373,10 +2374,8 @@ gst_matroska_mux_subtitle_pad_setcaps (GstPad * pad, GstCaps * caps)
   GST_COLLECT_PADS_STREAM_LOCK (mux->collect);
   GST_COLLECT_PADS_STATE_UNSET (data, GST_COLLECT_PADS_STATE_LOCKED);
   gst_collect_pads_set_waiting (mux->collect, data, FALSE);
-  GST_COLLECT_PADS_STATE_SET (data, GST_COLLECT_PADS_STATE_LOCKED);
   GST_COLLECT_PADS_STREAM_UNLOCK (mux->collect);
 
-
 exit:
 
   return ret;