From 2edf5577b2048e3a746a4fc75712d020e98e7a39 Mon Sep 17 00:00:00 2001
From: Fabrice Bellet <fabrice@bellet.info>
Date: Tue, 23 May 2017 16:06:47 +0200
Subject: [PATCH] rtp: fix a double locking issue on the session

The session value used in fs_rtp_stream_add_substream_unlock(), taken
from the stream struct may be null, while the session value from
fs_rtp_session_new_recv_pad() is not. However these two function depend
on the same session value to properly lock and unlock it: the first
function will unlock the session previously locked by the second
function.
---
 gst/fsrtpconference/fs-rtp-session.c |  6 +++---
 gst/fsrtpconference/fs-rtp-stream.c  | 12 ++++++++----
 gst/fsrtpconference/fs-rtp-stream.h  |  1 +
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/gst/fsrtpconference/fs-rtp-session.c b/gst/fsrtpconference/fs-rtp-session.c
index 86eefbb..bcee590 100644
--- a/gst/fsrtpconference/fs-rtp-session.c
+++ b/gst/fsrtpconference/fs-rtp-session.c
@@ -3290,7 +3290,7 @@ fs_rtp_session_new_recv_pad (FsRtpSession *session, GstPad *new_pad,
 
   if (stream)
   {
-    if (!fs_rtp_stream_add_substream_unlock (stream, substream, &error))
+    if (!fs_rtp_stream_add_substream_unlock (stream, substream, session, &error))
     {
       g_prefix_error (&error,
           "Could not add the output ghostpad to the new substream: ");
@@ -4363,7 +4363,7 @@ fs_rtp_session_associate_free_substreams (FsRtpSession *session,
         g_signal_handlers_disconnect_by_func (substream, "no-rtcp-timedout",
             session) > 0);
 
-    if (fs_rtp_stream_add_substream_unlock (stream, substream, &error))
+    if (fs_rtp_stream_add_substream_unlock (stream, substream, session, &error))
     {
       GST_DEBUG ("Associated SSRC %x in session %u", ssrc, session->id);
     }
@@ -4488,7 +4488,7 @@ _substream_no_rtcp_timedout_cb (FsRtpSubStream *substream,
 
   first_stream = g_list_first (session->priv->streams)->data;
   g_object_ref (first_stream);
-  if (!fs_rtp_stream_add_substream_unlock (first_stream, substream, &error))
+  if (!fs_rtp_stream_add_substream_unlock (first_stream, substream, session, &error))
   {
     g_prefix_error (&error,
         "Could not link the substream to a stream: ");
diff --git a/gst/fsrtpconference/fs-rtp-stream.c b/gst/fsrtpconference/fs-rtp-stream.c
index 593af4d..c2b9692 100644
--- a/gst/fsrtpconference/fs-rtp-stream.c
+++ b/gst/fsrtpconference/fs-rtp-stream.c
@@ -1013,6 +1013,7 @@ _substream_unlinked (FsRtpSubStream *substream, gpointer user_data)
  * fs_rtp_stream_add_substream_unlock:
  * @stream: a #FsRtpStream
  * @substream: the #FsRtpSubStream to associate with this stream
+ * @session: the #FsRtpSession to be unlocked
  *
  * This functions associates a substream with this stream
  *
@@ -1024,13 +1025,18 @@ _substream_unlinked (FsRtpSubStream *substream, gpointer user_data)
 gboolean
 fs_rtp_stream_add_substream_unlock (FsRtpStream *stream,
     FsRtpSubStream *substream,
+    FsRtpSession *session,
     GError **error)
 {
   gboolean ret = TRUE;
-  FsRtpSession *session = fs_rtp_stream_get_session (stream, error);
+  FsRtpSession *mysession = fs_rtp_stream_get_session (stream, error);
 
-  if (!session)
+  if (!mysession) {
+    FS_RTP_SESSION_UNLOCK (session);
     return FALSE;
+  }
+
+  g_object_unref (mysession);
 
   stream->substreams = g_list_prepend (stream->substreams,
       substream);
@@ -1056,8 +1062,6 @@ fs_rtp_stream_add_substream_unlock (FsRtpStream *stream,
   else
     FS_RTP_SESSION_UNLOCK (session);
 
-  g_object_unref (session);
-
   return ret;
 }
 
diff --git a/gst/fsrtpconference/fs-rtp-stream.h b/gst/fsrtpconference/fs-rtp-stream.h
index a4b3fb2..86674c3 100644
--- a/gst/fsrtpconference/fs-rtp-stream.h
+++ b/gst/fsrtpconference/fs-rtp-stream.h
@@ -117,6 +117,7 @@ FsRtpStream *fs_rtp_stream_new (FsRtpSession *session,
 
 gboolean fs_rtp_stream_add_substream_unlock (FsRtpStream *stream,
     FsRtpSubStream *substream,
+    FsRtpSession *session,
     GError **error);
 
 void
-- 
2.9.4