From d22be5d383dff7dd116e6ccc890e079950d65dd7 Mon Sep 17 00:00:00 2001 From: David Monge Date: Wed, 25 Jun 2025 09:30:15 -0600 Subject: [PATCH] mpegtsmux: fix double free caused by shared PMT descriptor The PMT descriptor was owned by the stream object but also added to the descriptors array without copying, leading to a double free and core dump during cleanup Part-of: --- subprojects/gst-plugins-bad/gst/mpegtsmux/tsmux/tsmuxstream.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/subprojects/gst-plugins-bad/gst/mpegtsmux/tsmux/tsmuxstream.c b/subprojects/gst-plugins-bad/gst/mpegtsmux/tsmux/tsmuxstream.c index f0e9092ef0..501cb55b07 100644 --- a/subprojects/gst-plugins-bad/gst/mpegtsmux/tsmux/tsmuxstream.c +++ b/subprojects/gst-plugins-bad/gst/mpegtsmux/tsmux/tsmuxstream.c @@ -1054,7 +1054,8 @@ tsmux_stream_default_get_es_descrs (TsMuxStream * stream, descriptor = gst_mpegts_descriptor_from_registration ("AV1G", NULL, 0); g_ptr_array_add (pmt_stream->descriptors, descriptor); if (stream->pmt_descriptor) - g_ptr_array_add (pmt_stream->descriptors, stream->pmt_descriptor); + g_ptr_array_add (pmt_stream->descriptors, + gst_mpegts_descriptor_copy (stream->pmt_descriptor)); } if (stream->internal_stream_type == TSMUX_ST_PS_TELETEXT) { // FIXME empty descriptor for now;