Fix a potential corruption in release_input_thread().

If the media instance owns the input and libvlc_media_instance_release()
is called immediately after libvlc_media_instance_stop(), there is a
chance that we try to free the input resources before the thread is
effectively terminated. To avoid this, we call input_DestroyThread()
instead of vlc_object_release() at the end of release_input_thread() when
the media instance owns the input thread.

diff --git a/src/control/media_instance.c b/src/control/media_instance.c
index c3ade3bea44e8e72030e7c7e451b27cdd043f280..afcdfc2f8187947f65243b0cec11fab0fb067c0c 100644 (file)
--- a/src/control/media_instance.c
+++ b/src/control/media_instance.c
@@ -92,11 +92,12 @@ static void release_input_thread( libvlc_media_instance_t *p_mi )
 
         /* We owned this one */
         input_StopThread( p_input_thread );
+        input_DestroyThread( p_input_thread );
 
         var_Destroy( p_input_thread, "drawable" );
     }
-
-    vlc_object_release( p_input_thread );
+    else
+        vlc_object_release( p_input_thread );
 
     p_mi->p_input_thread = NULL;
 }