[Bug 675640] New: shmsink memory corruption when a client disconnects (more than one client)

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=675640
  GStreamer | gst-plugins-bad | 0.10.x

           Summary: shmsink memory corruption when a client disconnects
                    (more than one client)
    Classification: Platform
           Product: GStreamer
           Version: 0.10.x
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: gst-plugins-bad
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: aleix at oblong.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---


If more than one shmsrc client is connected to a shmsink a race condition might
occur.

Supose we have clients C1 and C2 and buffer B (with use_count=2).

In pollthread_func client loop (client C1 has disconnected at some point during
next steps),

- Client C1 decrement the use count of buffer B (sp_writer_recv ->
use_count=1).
- Client C2 gst_poll_fd_can_read returns FALSE (sp_writer_recv *not* called).

- pollthread_func is called again (before gst-shm_sink_render).

- Client C1 has closed (sp_writer_close_client -> use_count=0 -> free buffer).
<--- ERROR Client C1 has already decremented use count for buffer B.
- Client C2 pipe still has buffer B <--- ERROR (it has already been freed)!

The attached patch solves this issue by removing the client from the list of
buffer users when the use count is decremented for that buffer. This way, when
the client closes, it does not try to decrement buffer use count again.

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.