[gstreamer-bugs] [Bug 439255] [rtspsrc] crash on unsupported transport

GStreamer (bugzilla.gnome.org) bugzilla-daemon at bugzilla.gnome.org
Fri May 18 05:00:14 PDT 2007

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:

  GStreamer | gst-plugins-good | Ver: HEAD CVS

Tim-Philipp Müller changed:

           What    |Removed                     |Added
                 CC|                            |wim at fluendo.com
         AssignedTo|totem-gstreamer-            |gstreamer-
                   |maint at gnome.bugs            |bugs at lists.sourceforge.net
             Status|UNCONFIRMED                 |NEW
          Component|GStreamer backend           |gst-plugins-good
     Ever Confirmed|0                           |1
            Product|totem                       |GStreamer
          QAContact|totem-gstreamer-            |gstreamer-
                   |maint at gnome.bugs            |bugs at lists.sourceforge.net
            Summary|crash in Movie Player:      |[rtspsrc] crash on
                   |Trying to listen to audi... |unsupported transport
   Target Milestone|---                         |HEAD
            Version|2.19.x                      |HEAD CVS

------- Comment #3 from Tim-Philipp Müller  2007-05-18 12:00 UTC -------
Can reproduce. The bug still exists in GStreamer CVS. I know what the problem
is, but I'm not entirely sure about the supposed logic of the code, so I'll
better let Wim fix it.

In gst-plugins-good/gst/rtsp/gstrtspsrc.c, gst_rtspsrc_setup_streams():

    switch (code) {
      case RTSP_STS_OK:
        /* cleanup of leftover transport */
        gst_rtspsrc_stream_free_udp (stream);
        goto next_stream;
        goto send_error;

    /* parse response transport */
      RTSPTransport transport = { 0 };


      /* clean up our transport struct */
      rtsp_transport_init (&transport);

The 'goto next_stream' from the switch jumps directly into the parse block,
where it'll try to clear the transport variable. However, because of the goto
statement the transport variable has either not been cleared or not been
allocated on the stack in the first place, so rtsp_transport_init() will try to
free a garbage pointer when doing g_free(transport->foobar).

Also, I'm wondering if in the if() construction above next_stream there's a
jump/continue/something missing.

See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=439255.

More information about the Gstreamer-bugs mailing list