In the function mpegts_get_descriptor_from_stream() in:
 gst-plugins-bad\gst\mpegtsdemux\mpegtsbase.c 
is the following code:

  for (i = 0; i < descriptors->n_values; i++) {
    GValue *value = g_value_array_get_nth (descriptors, i);
    GString *desc = g_value_dup_boxed (value);
    if (DESC_TAG (desc->str) == tag) {
      retval = (guint8 *) desc->str;
      g_string_free (desc, FALSE);
      break;
    } else
      g_string_free (desc, FALSE);      // <<< should be TRUE?
  }

If we find the matching tag, we want to keep desc->str, but free desc.
If we don't match, we want to delete both, I think.

Changing to "TRUE" fixed a memory leak for me.