Created attachment 243438 [details] [review]
Proposed fix

In the mpegtsmux collect pads clip function (mpegtsmux_clip_inc_running_time), it is possible that a "prepare" function is necessary to modify the incoming buffer when it arrives on a pad (AC3 audio uses this prepare_func).  The prepare returns a newly alloc'd GstBuffer based on the incoming buffer data.  The call is made like this:

  if (pad_data->prepare_func) {
    MpegTsMux *mux = (MpegTsMux *) user_data;

    buf = pad_data->prepare_func (buf, pad_data, mux);
    if (buf)
      gst_buffer_replace (outbuf, buf);
  }

Since the clip function is supposed to return the buffer in an output parameter and not as a return value, the buffer returned from the prepare_func is passed to gst_buffer_replace.  gst_buffer_replace serves the purpose of allowing the new buffer to returned in a function parameter, but I think is has the unintended side-effect of reffing the buffer one more time.

My proposed patch will just add a call to gst_buffer_unref after gst_buffer_replace.  The other possible solution is to not use gst_buffer_replace at all and just do "*outbuf = buf".  I'm not sure if the atomicity of gst_buffer_replace is really necessary.