rtspsrc: Fix for segmentation fault when handling set/get_parameter requests

gstrtspsrc uses a queue, set_get_param_q, to store set param and get
param requests. The requests are put on the queue by calling
get_parameters() and set_parameter(). A thread which executs in
gst_rtspsrc_thread() then pops requests from the queue and processes
them. The crash occured because the queue became empty and a NULL
request object was then used. The reason that the queue became empty
is that it was popped even when the thread was NOT processing a get
parameter or set parameter command. The fix is to make sure that the
queue is ONLY popped when the command being processed is a set
parameter or get parameter command.

1 files changed, 7 insertions, 1 deletions

diff --git a/gst/rtsp/gstrtspsrc.c b/gst/rtsp/gstrtspsrc.c
index cc97bf75f..db671c7c9 100644
--- a/gst/rtsp/gstrtspsrc.c
+++ b/gst/rtsp/gstrtspsrc.c
@@ -8750,7 +8750,9 @@ gst_rtspsrc_thread (GstRTSPSrc * src)
       src->pending_cmd = CMD_LOOP;
     } else {
       ParameterRequest *next_req;
-      req = g_queue_pop_head (&src->set_get_param_q);
+      if (cmd == CMD_GET_PARAMETER || cmd == CMD_SET_PARAMETER) {
+        req = g_queue_pop_head (&src->set_get_param_q);
+      }
       next_req = g_queue_peek_head (&src->set_get_param_q);
       src->pending_cmd = next_req ? next_req->cmd : CMD_LOOP;
     }
@@ -9123,6 +9125,8 @@ gst_rtspsrc_get_parameter (GstRTSPSrc * src, ParameterRequest * req)
 
   GST_DEBUG_OBJECT (src, "creating server get_parameter");
 
+  g_assert (req);
+
   if ((res = gst_rtspsrc_ensure_open (src, FALSE)) < 0)
     goto open_failed;
 
@@ -9240,6 +9244,8 @@ gst_rtspsrc_set_parameter (GstRTSPSrc * src, ParameterRequest * req)
 
   GST_DEBUG_OBJECT (src, "creating server set_parameter");
 
+  g_assert (req);
+
   if ((res = gst_rtspsrc_ensure_open (src, FALSE)) < 0)
     goto open_failed;