GNOME Bugzilla – Bug 748412
tsdemux: possible refcount bug in applying PMT
Last modified: 2015-05-18 15:15:34 UTC
In gst/mpegtsdemux/mpegtsbase.c, apply_pmt: /* If the current program is active, this means we have a new program */ if (old_program->active) { old_program = mpegts_base_steal_program (base, program_number); program = mpegts_base_new_program (base, program_number, section->pid); g_hash_table_insert (base->programs, GINT_TO_POINTER (program_number), program); This will create a new program with patcount 0. When a new PAT is encountered, if it still references this program number, the patcount will be both incremented and decremented, which will end up deleting that program. File with this PMT change: http://people.collabora.com/~tester/pmt-change-2.ts Setting the patcount to 1 when creating this new program makes it survive, but seems wrong, as the program number is not found in the existing PAT by: program = mpegts_base_get_program (base, program_number); This seems to be because the program number was just "stolen" from the hash table just before, for reasons I have no idea about. Maybe the patcount should be copied from old_program to the new program instead ? I've no idea what the intent of this swapping code is so I'm not sure.
Created attachment 302289 [details] [review] fix refcounting when applying a new PMT I think copying the refcount is the correct thing to do, given the new program shadows the one stolen from the hash table. It works with the sample file (till next problem anyway). Needs someone with MPEG-TS knowledge to double check sanity.