[gstreamer-bugs] [Bug 439255] [rtspsrc] crash on unsupported transport

[GStreamer (bugzilla.gnome.org)]

If you have any questions why you received this email, please see the text at
the end of this email. Replies to this email are NOT read, please see the text
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=439255

  GStreamer | gst-plugins-good | Ver: HEAD CVS

Tim-Philipp Müller changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wim at fluendo.com
         AssignedTo|totem-gstreamer-            |gstreamer-
                   |maint at gnome.bugs            |bugs at lists.sourceforge.net
             Status|UNCONFIRMED                 |NEW
          Component|GStreamer backend           |gst-plugins-good
     Ever Confirmed|0                           |1
            Product|totem                       |GStreamer
          QAContact|totem-gstreamer-            |gstreamer-
                   |maint at gnome.bugs            |bugs at lists.sourceforge.net
            Summary|crash in Movie Player:      |[rtspsrc] crash on
                   |Trying to listen to audi... |unsupported transport
   Target Milestone|---                         |HEAD
            Version|2.19.x                      |HEAD CVS




------- Comment #3 from Tim-Philipp Müller  2007-05-18 12:00 UTC -------
Can reproduce. The bug still exists in GStreamer CVS. I know what the problem
is, but I'm not entirely sure about the supposed logic of the code, so I'll
better let Wim fix it.

In gst-plugins-good/gst/rtsp/gstrtspsrc.c, gst_rtspsrc_setup_streams():

    switch (code) {
      case RTSP_STS_OK:
        break;
      case RTSP_STS_UNSUPPORTED_TRANSPORT:
        /* cleanup of leftover transport */
        gst_rtspsrc_stream_free_udp (stream);
        goto next_stream;
      default:
        goto send_error;
    }

    /* parse response transport */
    {
      RTSPTransport transport = { 0 };

      ...

    next_stream:
      /* clean up our transport struct */
      rtsp_transport_init (&transport);
    }
  }

The 'goto next_stream' from the switch jumps directly into the parse block,
where it'll try to clear the transport variable. However, because of the goto
statement the transport variable has either not been cleared or not been
allocated on the stack in the first place, so rtsp_transport_init() will try to
free a garbage pointer when doing g_free(transport->foobar).

Also, I'm wondering if in the if() construction above next_stream there's a
jump/continue/something missing.


-- 
See http://bugzilla.gnome.org/page.cgi?id=email.html for more info about why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?id=439255.