From: Gilbok Lee <gilbok.lee@samsung.com>
Date: Tue, 20 Apr 2021 08:31:24 +0000 (+0900)
Subject: [0.6.253] Fix wrong memory free, when the pipeline is destroyed
X-Git-Tag: accepted/tizen/unified/20210422.005409^0
X-Git-Url: http://review.tizen.org/git/?p=platform%2Fcore%2Fmultimedia%2Flibmm-player.git;a=commitdiff_plain;h=9cfc2d4c02ee9621a9ec86fa58abc8032528f6d7

[0.6.253] Fix wrong memory free, when the pipeline is destroyed

- videobin is already freed in _mmplayer_gst_decode_pad_removed()

Change-Id: Ic92d041eeb6e3967c08ac30cf3c8125e72be510e
---

diff --git a/packaging/libmm-player.spec b/packaging/libmm-player.spec
index 8658359..03fc1c1 100644
--- a/packaging/libmm-player.spec
+++ b/packaging/libmm-player.spec
@@ -1,6 +1,6 @@
 Name:       libmm-player
 Summary:    Multimedia Framework Player Library
-Version:    0.6.252
+Version:    0.6.253
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0
diff --git a/src/mm_player_priv.c b/src/mm_player_priv.c
index 77743ac..6e3f150 100644
--- a/src/mm_player_priv.c
+++ b/src/mm_player_priv.c
@@ -4373,9 +4373,6 @@ __mmplayer_gst_destroy_pipeline(mmplayer_t *player)
 		__mmplayer_release_signal_connection(player, MM_PLAYER_SIGNAL_TYPE_ALL);
 
 		if (mainbin) {
-			mmplayer_gst_element_t *audiobin = player->pipeline->audiobin;
-			mmplayer_gst_element_t *videobin = player->pipeline->videobin;
-			mmplayer_gst_element_t *textbin = player->pipeline->textbin;
 			GstBus *bus = gst_pipeline_get_bus(GST_PIPELINE(mainbin[MMPLAYER_M_PIPE].gst));
 			gst_bus_set_sync_handler(bus, NULL, NULL, NULL);
 			gst_object_unref(bus);
@@ -4395,9 +4392,9 @@ __mmplayer_gst_destroy_pipeline(mmplayer_t *player)
 			if (mainbin[MMPLAYER_M_SRC_FAKESINK].gst)
 				gst_object_unref(GST_OBJECT(mainbin[MMPLAYER_M_SRC_FAKESINK].gst));
 
-			MMPLAYER_FREEIF(audiobin);
-			MMPLAYER_FREEIF(videobin);
-			MMPLAYER_FREEIF(textbin);
+			MMPLAYER_FREEIF(player->pipeline->audiobin);
+			MMPLAYER_FREEIF(player->pipeline->videobin);
+			MMPLAYER_FREEIF(player->pipeline->textbin);
 			MMPLAYER_FREEIF(mainbin);
 		}
 
@@ -7519,10 +7516,12 @@ _mmplayer_gst_decode_pad_removed(GstElement *elem, GstPad *pad,
 
 	__mmplayer_release_signal_connection(player, MM_PLAYER_SIGNAL_TYPE_VIDEOBIN);
 
-	ret = _mmplayer_gst_set_state(player, mainbin[MMPLAYER_M_V_CONCAT].gst, GST_STATE_NULL, FALSE, timeout);
-	if (ret != MM_ERROR_NONE) {
-		LOGE("fail to change state to NULL");
-		return;
+	if (!gst_bin_remove(GST_BIN_CAST(mainbin[MMPLAYER_M_PIPE].gst), videobin[MMPLAYER_V_BIN].gst)) {
+		LOGE("failed to remove videobin");
+	}
+
+	if (!gst_bin_remove(GST_BIN_CAST(mainbin[MMPLAYER_M_PIPE].gst), mainbin[MMPLAYER_M_V_CONCAT].gst)) {
+		LOGE("failed to remove video concat");
 	}
 
 	ret = _mmplayer_gst_set_state(player, videobin[MMPLAYER_V_BIN].gst, GST_STATE_NULL, FALSE, timeout);
@@ -7531,12 +7530,10 @@ _mmplayer_gst_decode_pad_removed(GstElement *elem, GstPad *pad,
 		return;
 	}
 
-	if (!gst_bin_remove(GST_BIN_CAST(mainbin[MMPLAYER_M_PIPE].gst), mainbin[MMPLAYER_M_V_CONCAT].gst)) {
-		LOGE("failed to remove video concat");
-	}
-
-	if (!gst_bin_remove(GST_BIN_CAST(mainbin[MMPLAYER_M_PIPE].gst), videobin[MMPLAYER_V_BIN].gst)) {
-		LOGE("failed to remove videobin");
+	ret = _mmplayer_gst_set_state(player, mainbin[MMPLAYER_M_V_CONCAT].gst, GST_STATE_NULL, FALSE, timeout);
+	if (ret != MM_ERROR_NONE) {
+		LOGE("fail to change state to NULL");
+		return;
 	}
 
 	gst_object_unref(GST_OBJECT(mainbin[MMPLAYER_M_V_CONCAT].gst));