From: Edward Hervey <edward@centricular.com>
Date: Wed, 11 Nov 2020 17:07:57 +0000 (+0100)
Subject: hlsdemux: Don't double-free variant streams on errors
X-Git-Tag: submit/tizen/20210823.074442^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=16e25e51fecfbd2f120823066dfabcc3f46bc647;p=platform%2Fupstream%2Fgst-plugins-bad.git

hlsdemux: Don't double-free variant streams on errors

If an error happened switching to a new variant, we switch back to the previous
one ... except it will be unreffed when settin git.

In order to avoid such issues, keep a reference to the old variant until we're
sure we don't need it anymore

Fixes cases of double-free on variants and its contents

Change-Id: I2829e42d87e9d9218073aaa24ca18474748b092f
Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1799>
---

diff --git a/ext/hls/gsthlsdemux.c b/ext/hls/gsthlsdemux.c
index b6f67ab94..47356f053 100644
--- a/ext/hls/gsthlsdemux.c
+++ b/ext/hls/gsthlsdemux.c
@@ -2067,7 +2067,12 @@ gst_hls_demux_change_playlist (GstHLSDemux * demux, guint max_bitrate,
 
   stream = adaptive_demux->streams->data;
 
+#ifdef TIZEN_FEATURE_UPSTREAM
+  /* Make sure we keep a reference in case we need to switch back */
+  previous_variant = gst_hls_variant_stream_ref (demux->current_variant);
+#else
   previous_variant = demux->current_variant;
+#endif
 #ifdef TIZEN_FEATURE_ADAPTIVE_MODIFICATION
   new_variant =
       gst_hls_master_playlist_get_variant_for_bandwitdh_limit (demux->master,
@@ -2091,6 +2096,9 @@ retry_failover_protection:
   /* Don't do anything else if the playlist is the same */
   if (new_bandwidth == old_bandwidth) {
     GST_M3U8_CLIENT_UNLOCK (demux->client);
+#ifdef TIZEN_FEATURE_UPSTREAM
+    gst_hls_variant_stream_unref (previous_variant);
+#endif
     return TRUE;
   }
 
@@ -2152,6 +2160,9 @@ retry_failover_protection:
     return gst_hls_demux_change_playlist (demux, new_bandwidth - 1, changed);
   }
 
+#ifdef TIZEN_FEATURE_UPSTREAM
+  gst_hls_variant_stream_unref (previous_variant);
+#endif
   return TRUE;
 }