rtph265pay: fix potential crash when shutting down

A race condition in the state change function may cause buffers to be
unreffed while they are still used by the streaming thread in
gst_rtp_h265_pay_send_vps_sps_pps() resulting in a crash. Chain up to the
parent class first in the state change function to make sure streaming
has stopped and only then free those buffers.

https://bugzilla.gnome.org/show_bug.cgi?id=741381

1 files changed, 7 insertions, 2 deletions

diff --git a/gst/rtp/gstrtph265pay.c b/gst/rtp/gstrtph265pay.c
index 0a5bac611..1ed17f88f 100644
--- a/gst/rtp/gstrtph265pay.c
+++ b/gst/rtp/gstrtph265pay.c
@@ -1431,6 +1431,13 @@ gst_rtp_h265_pay_change_state (GstElement * element, GstStateChange transition)
       rtph265pay->send_vps_sps_pps = FALSE;
       gst_adapter_clear (rtph265pay->adapter);
       break;
+    default:
+      break;
+  }
+
+  ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition);
+
+  switch (transition) {
     case GST_STATE_CHANGE_PAUSED_TO_READY:
       rtph265pay->last_vps_sps_pps = -1;
       gst_rtp_h265_pay_clear_vps_sps_pps (rtph265pay);
@@ -1439,8 +1446,6 @@ gst_rtp_h265_pay_change_state (GstElement * element, GstStateChange transition)
       break;
   }
 
-  ret = GST_ELEMENT_CLASS (parent_class)->change_state (element, transition);
-
   return ret;
 }