GNOME Bugzilla – Bug 688707
rtsp-media: bus watch can outlive the rtsp-media object
Last modified: 2014-02-25 22:27:50 UTC
Created attachment 229447 [details] Valgrind run In gst-rtsp-server, I run a unit test in Valgrind: GST_CHECKS=test_describe make -C tests/check gst/rtspserver.valgrind I get several invalid reads. Please see the attached file. These invalid reads come in the bus watch (bus_message) in rtsp-media.c. The RTSPClient has shut down. Its finalize method has unreffed the last reference to its RTSPMedia, which also gets finalized. gst_rtsp_media_finalize clears the state_lock GRecMutex. Then, a (last) message comes to the bus_message handler. There, state_lock is accessed after it has been cleared.
Created attachment 229448 [details] [review] Remove bus watch before finalizing A suggested fix is attached: * A GDestroyNotify function is set for the bus watch in gst_rtsp_media_prepare. * An extra media ref is added for the bus watch. This extra ref is unreffed by the GDestroyNotify function. * gst_rtsp_media_unprepare destroys the source so the bus watch is removed. * GstRTSPClient, which calls gst_rtsp_media_prepare, also calls gst_rtsp_media_unprepare before unreffing the media. This way, the bus watch will be removed before the media is finalized.
I changed it so that the source is removed in finish_unprepare in the case of clean shutdown. commit 989f004e24e6e6e8d8a0a041849d9ce593403666 Author: Wim Taymans <wim.taymans@collabora.co.uk> Date: Tue Nov 20 09:42:51 2012 +0100 media: unref source in finish_unprepare The source is created in prepare, unref it in finish_unprepare. See https://bugzilla.gnome.org/show_bug.cgi?id=688707 commit 01973c924d3fc850b812a7aaf1b2691a8fd01ae0 Author: David Svensson Fors <davidsf@axis.com> Date: Mon Nov 19 15:47:08 2012 +0100 rtsp-media: remove bus watch before finalizing * A GDestroyNotify function is set for the bus watch in gst_rtsp_media_prepare. * An extra media ref is added for the bus watch. This extra ref is unreffed by the GDestroyNotify function. * gst_rtsp_media_unprepare destroys the source so the bus watch is removed. * GstRTSPClient, which calls gst_rtsp_media_prepare, also calls gst_rtsp_media_unprepare before unreffing the media. This way, the bus watch will be removed before the media is finalized. Fixes https://bugzilla.gnome.org/show_bug.cgi?id=688707