rtpsession releases RTP_SESSION_LOCK while iterating the ssrc hashtable
@ocrete
Submitted by Olivier Crête Link to original bug (#784534)
Description
While fixing bug 773218, I discovered a new problem in rtpsession, we release the LOCK while iterating over the ssrcs hash table using g_hash_table_foreach(). If we're unlucky, that can result in the hash table being modified during the iteration which hits a critical inside GHashTable.
The call sequence is the following:
rtp_session_on_timeout() -> g_hash_table_foreach() -> generate_rtcp() -> session_start_rtcp() -> rtp_source_get_new_sr() -> get_clock_rate() -> source_clock_rate()
To reproduce, in gst-plugins-good:
GST_CHECKS=test_sender_eos make elements/rtpbin.forever
Version: 1.12.x