[gstreamer-bugs] [Bug 562319] New: [rtpsession] memory corruption

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=562319

  GStreamer | gst-plugins-bad | Ver: HEAD CVS
           Summary: [rtpsession] memory corruption
           Product: GStreamer
           Version: HEAD CVS
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-bad
        AssignedTo: gstreamer-bugs at lists.sourceforge.net
        ReportedBy: gstelzz at yahoo.fr
         QAContact: gstreamer-bugs at lists.sourceforge.net
     GNOME version: Unspecified
   GNOME milestone: Unspecified


Running my application under valgrind, I get the attached output.

In rtp_session_process_rtp, the source have been freed after obtain_source.
I suspect a race condition when releasing the lock while performing call backs
(on_xxx).
There is a window during which any thread can take the lock, especially the
rtcp_thread which performs the session cleanup.
So, any time a callback is called, the current used source should be considered
no more valid, even if it seems to be inside a lock.
In rtp_session_process_rtp, calling on_ssrc_validated or on_new_ssrc enables
session_cleanup to be performed, thus invalidating source.
Source should be protected by referencing it whenever it is taken from
hash_table.

There may also be a problem with hash_table concurrency.
Because of call backs, the lock can be released while
g_hash_table_foreach_remove and another thread may perform g_hash_table_lookup
or g_hash_table_insert.
Is this safe ?


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=562319.