From: Sebastian Dröge <sebastian@centricular.com>
Date: Fri, 1 Oct 2021 10:51:37 +0000 (+0300)
Subject: rtsp-session: Don't unref medias twice if it is removed inside gst_rtsp_session_filte... 
X-Git-Tag: 1.19.3~392
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=7aa88364ac3f07d33450886df82f377c57d0f374;p=platform%2Fupstream%2Fgstreamer.git

rtsp-session: Don't unref medias twice if it is removed inside gst_rtsp_session_filter() while the mutex is shortly released

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/757

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1004>
---

diff --git a/subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-session.c b/subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-session.c
index b21d615..b1b0799 100644
--- a/subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-session.c
+++ b/subprojects/gst-rtsp-server/gst/rtsp-server/rtsp-session.c
@@ -454,19 +454,38 @@ restart:
       res = func (sess, media, user_data);
 
       g_mutex_lock (&priv->lock);
-    } else
+    } else {
       res = GST_RTSP_FILTER_REF;
+    }
 
     changed = (cookie != priv->medias_cookie);
 
     switch (res) {
       case GST_RTSP_FILTER_REMOVE:
-        if (changed)
-          priv->medias = g_list_remove (priv->medias, media);
-        else
+        if (changed) {
+          GList *l;
+
+          walk = NULL;
+
+          for (l = priv->medias; l; l = l->next) {
+            if (l->data == media) {
+              walk = l;
+              break;
+            }
+          }
+        }
+
+        /* The media might have been removed from the list while the mutex was
+         * unlocked above. In that case there's nothing else to do here as the
+         * only reference to the media owned by this function is in the
+         * visited hash table and that is released in the end
+         */
+        if (walk) {
           priv->medias = g_list_delete_link (priv->medias, walk);
+          g_object_unref (media);
+        }
+
         cookie = ++priv->medias_cookie;
-        g_object_unref (media);
         break;
       case GST_RTSP_FILTER_REF:
         result = g_list_prepend (result, g_object_ref (media));