From 6b5617c2a72a4a48fdccfe5dfcce3fa56a9ca738 Mon Sep 17 00:00:00 2001
From: Seungha Yang <sh.yang@lge.com>
Date: Fri, 20 Jan 2017 19:49:46 +0900
Subject: [PATCH] decodebin3: Fix crash caused by slot double freeing

Probe for MultiQueue source pad might receive EOS twice,
the first is fake-eos and the other is actual EOS.
And the slot can be freed with fake-eos/EOS if the slot has no input.

Since slot freeing is async, double free can be possible.
So, decodebin3 needs to remove the probe also with slot freeing.

https://bugzilla.gnome.org/show_bug.cgi?id=777530
---
 gst/playback/gstdecodebin3-parse.c | 3 +++
 gst/playback/gstdecodebin3.c       | 7 +++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/gst/playback/gstdecodebin3-parse.c b/gst/playback/gstdecodebin3-parse.c
index 174852fd28..729f45163b 100644
--- a/gst/playback/gstdecodebin3-parse.c
+++ b/gst/playback/gstdecodebin3-parse.c
@@ -585,6 +585,9 @@ parsebin_pad_removed_cb (GstElement * demux, GstPad * pad, DecodebinInput * inp)
           free_output_stream (dbin, output);
         }
         GST_DEBUG_OBJECT (pad, "No pending pad, Remove multiqueue slot");
+        if (slot->probe_id)
+          gst_pad_remove_probe (slot->src_pad, slot->probe_id);
+        slot->probe_id = 0;
         dbin->slots = g_list_remove (dbin->slots, slot);
         free_multiqueue_slot_async (dbin, slot);
       }
diff --git a/gst/playback/gstdecodebin3.c b/gst/playback/gstdecodebin3.c
index 53b0ba9037..f0d6acda96 100644
--- a/gst/playback/gstdecodebin3.c
+++ b/gst/playback/gstdecodebin3.c
@@ -1592,15 +1592,17 @@ multiqueue_src_probe (GstPad * pad, GstPadProbeInfo * info,
             dbin->output_streams = g_list_remove (dbin->output_streams, output);
             free_output_stream (dbin, output);
           }
+          slot->probe_id = 0;
           dbin->slots = g_list_remove (dbin->slots, slot);
           free_multiqueue_slot_async (dbin, slot);
           SELECTION_UNLOCK (dbin);
-          ret = GST_PAD_PROBE_HANDLED;
+          ret = GST_PAD_PROBE_REMOVE;
         }
         break;
       case GST_EVENT_CUSTOM_DOWNSTREAM:
         if (gst_event_has_name (ev, "decodebin3-custom-eos")) {
           slot->is_drained = TRUE;
+          ret = GST_PAD_PROBE_DROP;
           SELECTION_LOCK (dbin);
           if (slot->input == NULL) {
             GST_DEBUG_OBJECT (pad,
@@ -1612,11 +1614,12 @@ multiqueue_src_probe (GstPad * pad, GstPadProbeInfo * info,
                   g_list_remove (dbin->output_streams, output);
               free_output_stream (dbin, output);
             }
+            slot->probe_id = 0;
             dbin->slots = g_list_remove (dbin->slots, slot);
             free_multiqueue_slot_async (dbin, slot);
+            ret = GST_PAD_PROBE_REMOVE;
           }
           SELECTION_UNLOCK (dbin);
-          ret = GST_PAD_PROBE_DROP;
         }
         break;
       default: