hls segfaults

Submitted by Nicola @drakkan

Link to original bug (#797075)

Description

I see some crashs using playbin for an hls stream

• crash 1:

#0  0x00007fffef3cca26 in malloc () at /usr/lib/libc.so.6  
#1  0x00007fffef453b0f in __vasprintf_chk () at /usr/lib/libc.so.6  
#2  0x00007ffff7c54c5a in g_vasprintf () at /usr/lib/libglib-2.0.so.0  
#3  0x00007ffff7c2e0de in g_strdup_vprintf () at /usr/lib/libglib-2.0.so.0  
#4  0x00007ffff7c2e19a in g_strdup_printf () at /usr/lib/libglib-2.0.so.0  
#5  0x00007fff657d504e in uri_join (uri1=<optimized out>, uri2=0x7ffed0017015 "3304.ts")  
    at ../subprojects/gst-plugins-bad/ext/hls/m3u8.c:1111  
#6  0x00007fff657d583d in gst_m3u8_update (self=0x7ffed0016db0, data=<optimized out>)  
    at ../subprojects/gst-plugins-bad/ext/hls/m3u8.c:522  
#7  0x00007fff657cf5c9 in gst_hls_demux_update_playlist (demux=demux@entry=0x7ffef00ceec0, update=update@entry=1, err=err@entry=0x0) at ../subprojects/gst-plugins-bad/ext/hls/gsthlsdemux.c:1459  
#8  0x00007fff657cfcdf in gst_hls_demux_change_playlist (demux=demux@entry=0x7ffef00ceec0, max_bitrate=<optimized out>, changed=changed@entry=0x7ffee67fb2e4) at ../subprojects/gst-plugins-bad/ext/hls/gsthlsdemux.c:1599  
#9  0x00007fff657d0edd in gst_hls_demux_select_bitrate (stream=<optimized out>, bitrate=<optimized out>)  
    at ../subprojects/gst-plugins-bad/ext/hls/gsthlsdemux.c:1149  
#10 0x00007fff657c0c99 in gst_adaptive_demux_stream_select_bitrate (bitrate=<optimized out>, stream=0x7fff1412d830, demux=0x7ffef00ceec0) at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:4280  
#11 0x00007fff657c0c99 in gst_adaptive_demux_stream_advance_fragment_unlocked (duration=<optimized out>, stream=0x7fff1412d830, demux=0x7ffef00ceec0) at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:4232  
#12 0x00007fff657c0c99 in gst_adaptive_demux_stream_advance_fragment (demux=demux@entry=0x7ffef00ceec0, stream=stream@entry=0x7fff1412d830, duration=<optimized out>) at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:4153  
#13 0x00007fff657ce726 in gst_hls_demux_finish_fragment (demux=0x7ffef00ceec0, stream=0x7fff1412d830)  
    at ../subprojects/gst-plugins-bad/ext/hls/gsthlsdemux.c:953  
#14 0x00007fff657b477f in gst_adaptive_demux_eos_handling (stream=stream@entry=0x7fff1412d830)  
    at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:2730  
#15 0x00007fff657b4af9 in _src_event (pad=<optimized out>, parent=<optimized out>, event=0x7ffed4003d10)  
    at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:2748  
#16 0x00007ffff7dee277 in gst_pad_send_event_unchecked (pad=pad@entry=0x7fff1412acd0, event=event@entry=0x7ffed4003d10, type=<optimized out>, type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../subprojects/gstreamer/gst/gstpad.c:5757  
#17 0x00007ffff7dee7c4 in gst_pad_push_event_unchecked (pad=pad@entry=0x7fff1404f5b0, event=0x7ffed4003d10, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../subprojects/gstreamer/gst/gstpad.c:5402  
#18 0x00007ffff7deec34 in push_sticky (pad=pad@entry=0x7fff1404f5b0, ev=ev@entry=0x7ffee67fb600, user_data=user_data@entry=0x7---Type <return> to continue, or q <return> to quit---  
ffee67fb670) at ../subprojects/gstreamer/gst/gstevent.h:438  
#19 0x00007ffff7dec548 in events_foreach (pad=pad@entry=0x7fff1404f5b0, func=func@entry=0x7ffff7deebe0 <push_sticky>, user_data=user_data@entry=0x7ffee67fb670) at ../subprojects/gstreamer/gst/gstpad.c:608  
#20 0x00007ffff7df7b71 in check_sticky (event=0x7ffed4003d10, pad=0x7fff1404f5b0)  
    at ../subprojects/gstreamer/gst/gstpad.c:3977  
#21 0x00007ffff7df7b71 in gst_pad_push_event (pad=pad@entry=0x7fff1404f5b0, event=0x7ffed4003d10)  
    at ../subprojects/gstreamer/gst/gstpad.c:5533  
#22 0x00007ffff7df80f4 in event_forward_func (pad=pad@entry=0x7fff1404f5b0, data=data@entry=0x7ffee67fb770)  
    at ../subprojects/gstreamer/gst/gstevent.h:438  
#23 0x00007ffff7df446e in gst_pad_forward (pad=pad@entry=0x555556151d00, forward=forward@entry=0x7ffff7df8030 <event_forward_func>, user_data=user_data@entry=0x7ffee67fb770) at ../subprojects/gstreamer/gst/gstpad.c:3004  
#24 0x00007ffff7df45b5 in gst_pad_event_default (pad=0x555556151d00, parent=<optimized out>, event=0x7ffed4003d10)  
    at ../subprojects/gstreamer/gst/gstpad.c:3101  
#25 0x00007ffff7dee277 in gst_pad_send_event_unchecked (pad=pad@entry=0x555556151d00, event=event@entry=0x7ffed4003d10, type=<optimized out>, type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../subprojects/gstreamer/gst/gstpad.c:5757  
#26 0x00007ffff7dee7c4 in gst_pad_push_event_unchecked (pad=pad@entry=0x7fff1412a830, event=0x7ffed4003d10, type=type@entry=GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM) at ../subprojects/gstreamer/gst/gstpad.c:5402  
#27 0x00007ffff7deec34 in push_sticky (pad=pad@entry=0x7fff1412a830, ev=ev@entry=0x7ffee67fb970, user_data=user_data@entry=0x7ffee67fb9e0) at ../subprojects/gstreamer/gst/gstevent.h:438  
#28 0x00007ffff7dec548 in events_foreach (pad=pad@entry=0x7fff1412a830, func=func@entry=0x7ffff7deebe0 <push_sticky>, user_data=user_data@entry=0x7ffee67fb9e0) at ../subprojects/gstreamer/gst/gstpad.c:608  
#29 0x00007ffff7df7b71 in check_sticky (event=0x7ffed4003d10, pad=0x7fff1412a830)  
    at ../subprojects/gstreamer/gst/gstpad.c:3977  
#30 0x00007ffff7df7b71 in gst_pad_push_event (pad=0x7fff1412a830, event=event@entry=0x7ffed4003d10)  
    at ../subprojects/gstreamer/gst/gstpad.c:5533  
#31 0x00007fff8806626b in gst_queue_push_one (queue=0x7ffee0016010)  
    at ../subprojects/gstreamer/plugins/elements/gstqueue.c:1455  
#32 0x00007fff8806626b in gst_queue_loop (pad=<optimized out>) at ../subprojects/gstreamer/plugins/elements/gstqueue.c:1537  
#33 0x00007ffff7e24751 in gst_task_func (task=0x7fff1404c710) at ../subprojects/gstreamer/gst/gsttask.c:328  
#34 0x00007ffff7c37bf6 in  () at /usr/lib/libglib-2.0.so.0  
#35 0x00007ffff7c371ea in  () at /usr/lib/libglib-2.0.so.0  
#36 0x00007fffef840a9d in start_thread () at /usr/lib/libpthread.so.0  
  

crash 2:

#0  0x00007fffef4a6667 in __strlen_avx2 () at /usr/lib/libc.so.6  
#1  0x00007ffff7c2df54 in g_strdup () at /usr/lib/libglib-2.0.so.0  
#2  0x00007fff7d7cff10 in gst_hls_demux_update_fragment_info (stream=0x7ffed000e420)  
    at ../subprojects/gst-plugins-bad/ext/hls/gsthlsdemux.c:1102  
#3  0x00007fff7d7b3ba1 in gst_adaptive_demux_stream_update_fragment_info (demux=demux@entry=0x7fff141aa1f0, stream=stream@entry=0x7ffed000e420) at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:4303  
#4  0x00007fff7d7bde74 in gst_adaptive_demux_stream_download_loop (stream=0x7ffed000e420)  
    at ../subprojects/gst-plugins-bad/gst-libs/gst/adaptivedemux/gstadaptivedemux.c:3716  
#5  0x00007ffff7e24751 in gst_task_func (task=0x7ffee80c1dd0) at ../subprojects/gstreamer/gst/gsttask.c:328  
#6  0x00007ffff7c37bf6 in  () at /usr/lib/libglib-2.0.so.0  
#7  0x00007ffff7c371ea in  () at /usr/lib/libglib-2.0.so.0  
#8  0x00007fffef840a9d in start_thread () at /usr/lib/libpthread.so.0  
#9  0x00007fffef442a43 in clone () at /usr/lib/libc.so.6  
  

the same stream works with no crash in ffplay