From d73cda4fd13e27379036aee6c9e40436724fc10e Mon Sep 17 00:00:00 2001 From: Alexander Lapajne Date: Fri, 7 Feb 2020 10:03:49 +0100 Subject: rtspsrc: Fix for segmentation fault when handling set/get_parameter requests gstrtspsrc uses a queue, set_get_param_q, to store set param and get param requests. The requests are put on the queue by calling get_parameters() and set_parameter(). A thread which executs in gst_rtspsrc_thread() then pops requests from the queue and processes them. The crash occured because the queue became empty and a NULL request object was then used. The reason that the queue became empty is that it was popped even when the thread was NOT processing a get parameter or set parameter command. The fix is to make sure that the queue is ONLY popped when the command being processed is a set parameter or get parameter command. --- gst/rtsp/gstrtspsrc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gst/rtsp/gstrtspsrc.c b/gst/rtsp/gstrtspsrc.c index cc97bf75f..db671c7c9 100644 --- a/gst/rtsp/gstrtspsrc.c +++ b/gst/rtsp/gstrtspsrc.c @@ -8750,7 +8750,9 @@ gst_rtspsrc_thread (GstRTSPSrc * src) src->pending_cmd = CMD_LOOP; } else { ParameterRequest *next_req; - req = g_queue_pop_head (&src->set_get_param_q); + if (cmd == CMD_GET_PARAMETER || cmd == CMD_SET_PARAMETER) { + req = g_queue_pop_head (&src->set_get_param_q); + } next_req = g_queue_peek_head (&src->set_get_param_q); src->pending_cmd = next_req ? next_req->cmd : CMD_LOOP; } @@ -9123,6 +9125,8 @@ gst_rtspsrc_get_parameter (GstRTSPSrc * src, ParameterRequest * req) GST_DEBUG_OBJECT (src, "creating server get_parameter"); + g_assert (req); + if ((res = gst_rtspsrc_ensure_open (src, FALSE)) < 0) goto open_failed; @@ -9240,6 +9244,8 @@ gst_rtspsrc_set_parameter (GstRTSPSrc * src, ParameterRequest * req) GST_DEBUG_OBJECT (src, "creating server set_parameter"); + g_assert (req); + if ((res = gst_rtspsrc_ensure_open (src, FALSE)) < 0) goto open_failed; -- cgit v1.2.1