[Bug 692433] New: segmentation fault when client disconnects

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=692433
  GStreamer | gst-rtsp-server | 0.10.x

           Summary: segmentation fault when client disconnects
    Classification: Platform
           Product: GStreamer
           Version: 0.10.x
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: critical
          Priority: Normal
         Component: gst-rtsp-server
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: andyhelp at gmail.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---


Created an attachment (id=234287)
 View: https://bugzilla.gnome.org/attachment.cgi?id=234287
 Review: https://bugzilla.gnome.org/review?bug=692433&attachment=234287

sleep(5) addition to trigger the failure.

segmentation fault when client disconnects

When TCP client disconnects sometimes rtsp server crashes with segmentation
fault. With more clients disconnecting it is more likely to see the crash.
Streaming thread in do_send_data writes to client->watch which was already
freed when client disconnected. 
I think it also applies to RTP/UDP clients but is much less likely to happen.

I've added sleep(5) statement and couple of printfs to reproduce the failure
every time on PC. Additionally I find out that tr->send_rtp can be NULL in
handle_new_buffer function.
To reproduce I apply attached patch and run gst-launch client with (protocols=4
for TCP), then kill appropriate client with CTRL+C.
Client needs to be killed when additional debug prints "kill client 0x8227428
now .." :)

I'm not sure what is a best way to fix it?

Two crash cases:
--- 1 single client disconnection ---
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(0)..done
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(0)..done
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(0)..
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb56ffb40 (LWP 24959)]
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xb7d7195c in handle_new_buffer (sink=0x825a038, user_data=0x8246238) at
rtsp-media.c:1244
#2  0xb79a458b in gst_app_sink_render_common (psink=0x825a038, data=0xb4d03528,
is_list=0) at gstappsink.c:793


--- 2 second client disconnection ---
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(0)..done
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(0)..done
kill client 0x82672a8 now ..    sending data to watch 0x82672a8->0x8272008
(0)..done
kill client 0x8227428 now ..    sending data to watch 0x8227428->0x8227c00
(1)..done
kill client 0x82672a8 now ..*******client->watch destroyed 0x82672a8->0x8272008
        sending data to watch 0x82672a8->(nil) (0)..
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb56ffb40 (LWP 25209)]
0xb7d7194a in handle_new_buffer (sink=0x825a038, user_data=0x8246238) at
rtsp-media.c:1244
1244            tr->send_rtp (buffer, tr->transport->interleaved.min,
tr->user_data);
(gdb) bt
#0  0xb7d7194a in handle_new_buffer (sink=0x825a038, user_data=0x8246238) at
rtsp-media.c:1244
#1  0xb79a458b in gst_app_sink_render_common (psink=0x825a038, data=0xb4d030c0,
is_list=0) at gstappsink.c:793
#2  0xb7922639 in gst_base_sink_render_object
(basesink=basesink at entry=0x825a038, obj_type=obj_type at entry=2 '\002',

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.