msg_Unsubscribe: race condition memory leak

diff --git a/src/misc/messages.c b/src/misc/messages.c
index 087d9cd9b770bfce0cec5d07d1cb636880912474..29031f042d6fe22344c54fa29a3f4270546f9468 100644 (file)
--- a/src/misc/messages.c
+++ b/src/misc/messages.c
@@ -275,6 +275,15 @@ void msg_Unsubscribe (msg_subscription_t *sub)
     vlc_mutex_unlock (&bank->lock);
 
     vlc_join (sub->thread, NULL);
+
+    /* Free dangling (not flushed) messages. */
+    /* NOTE: no locking, only this thread can refer to the subscription now. */
+    while (sub->begin != sub->end)
+    {
+        msg_Release (sub->items[sub->begin]);
+        if (++sub->begin == VLC_MSG_QSIZE)
+            sub->begin = 0;
+    }
     free (sub);
 }