From: Seungha Yang <seungha@centricular.com>
Date: Thu, 22 Oct 2020 10:16:42 +0000 (+0900)
Subject: urisourcebin: Fix crash caused by use after free
X-Git-Tag: 1.19.3~511^2~392
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=5aa831223d594028cdf738cb6f406dd617926540;p=platform%2Fupstream%2Fgstreamer.git

urisourcebin: Fix crash caused by use after free

OutputSlotInfo doesn't hold ref of queue, so gst_bin_remove()
will free the queue memory.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/merge_requests/888>
---

diff --git a/gst/playback/gsturisourcebin.c b/gst/playback/gsturisourcebin.c
index f5633ba..b8100d2 100644
--- a/gst/playback/gsturisourcebin.c
+++ b/gst/playback/gsturisourcebin.c
@@ -2008,12 +2008,11 @@ free_output_slot (OutputSlotInfo * slot, GstURISourceBin * urisrc)
 
   gst_element_set_locked_state (slot->queue, TRUE);
   gst_element_set_state (slot->queue, GST_STATE_NULL);
+  remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue));
   gst_bin_remove (GST_BIN_CAST (urisrc), slot->queue);
 
   gst_object_unref (slot->sinkpad);
 
-  remove_buffering_msgs (urisrc, GST_OBJECT_CAST (slot->queue));
-
   /* deactivate and remove the srcpad */
   gst_pad_set_active (slot->srcpad, FALSE);
   gst_element_remove_pad (GST_ELEMENT_CAST (urisrc), slot->srcpad);