4 files changed, 28 insertions, 5 deletions
diff --git a/gst/rtpmanager/gstrtpbin.c b/gst/rtpmanager/gstrtpbin.c
index 5f781d8c..cf1983d7 100644
--- a/gst/rtpmanager/gstrtpbin.c
+++ b/gst/rtpmanager/gstrtpbin.c
@@ -604,7 +604,11 @@ get_pt_map (GstRtpBinSession * session, guint pt)
 
   g_signal_emitv (args, gst_rtp_bin_signals[SIGNAL_REQUEST_PT_MAP], 0, &ret);
 
-  caps = (GstCaps *) g_value_get_boxed (&ret);
+  g_value_unset (&args[0]);
+  g_value_unset (&args[1]);
+  g_value_unset (&args[2]);
+  caps = (GstCaps *) g_value_dup_boxed (&ret);
+  g_value_unset (&ret);
   if (!caps)
     goto no_caps;
 
@@ -662,6 +666,7 @@ gst_rtp_bin_clear_pt_map (GstRtpBin * bin)
   GST_RTP_BIN_UNLOCK (bin);
 }
 
+/* get a client with the given SDES name. Must be called with RTP_BIN_LOCK */
 static GstRtpBinClient *
 get_client (GstRtpBin * bin, guint8 len, guint8 * data, gboolean * created)
 {
@@ -698,6 +703,7 @@ get_client (GstRtpBin * bin, guint8 len, guint8 * data, gboolean * created)
 static void
 free_client (GstRtpBinClient * client)
 {
+  g_slist_free (client->streams);
   g_free (client->cname);
   g_free (client);
 }
@@ -713,6 +719,7 @@ gst_rtp_bin_associate (GstRtpBin * bin, GstRtpBinStream * stream, guint8 len,
   GSList *walk;
 
   /* first find or create the CNAME */
+  GST_RTP_BIN_LOCK (bin);
   client = get_client (bin, len, data, &created);
 
   /* find stream in the client */
@@ -830,16 +837,19 @@ gst_rtp_bin_associate (GstRtpBin * bin, GstRtpBinStream * stream, guint8 len,
           ostream->ssrc, ostream->ts_offset);
     }
   }
+  GST_RTP_BIN_UNLOCK (bin);
   return;
 
 no_clock_base:
   {
     GST_WARNING_OBJECT (bin, "we have no clock-base");
+    GST_RTP_BIN_UNLOCK (bin);
     return;
   }
 no_clock_rate:
   {
     GST_WARNING_OBJECT (bin, "we have no clock-rate");
+    GST_RTP_BIN_UNLOCK (bin);
     return;
   }
 }
@@ -2165,8 +2175,12 @@ gst_rtp_bin_get_free_pad_name (GstElement * element, GstPadTemplate * templ)
     pad_it = gst_element_iterate_pads (GST_ELEMENT (element));
     name_found = TRUE;
     while (gst_iterator_next (pad_it, (gpointer) & pad) == GST_ITERATOR_OK) {
-      if (strcmp (gst_pad_get_name (pad), pad_name) == 0)
+      gchar *name;
+
+      name = gst_pad_get_name (pad);
+      if (strcmp (name, pad_name) == 0)
         name_found = FALSE;
+      g_free (name);
     }
     gst_iterator_free (pad_it);
   }
diff --git a/gst/rtpmanager/gstrtpjitterbuffer.c b/gst/rtpmanager/gstrtpjitterbuffer.c
index 3d2e7797..3e5cb3b3 100644
--- a/gst/rtpmanager/gstrtpjitterbuffer.c
+++ b/gst/rtpmanager/gstrtpjitterbuffer.c
@@ -771,7 +771,10 @@ gst_rtp_jitter_buffer_get_clock_rate (GstRtpJitterBuffer * jitterbuffer,
   g_signal_emitv (args, gst_rtp_jitter_buffer_signals[SIGNAL_REQUEST_PT_MAP], 0,
       &ret);
 
-  caps = (GstCaps *) g_value_get_boxed (&ret);
+  g_value_unset (&args[0]);
+  g_value_unset (&args[1]);
+  caps = (GstCaps *) g_value_dup_boxed (&ret);
+  g_value_unset (&ret);
   if (!caps)
     goto no_caps;
 
diff --git a/gst/rtpmanager/gstrtpptdemux.c b/gst/rtpmanager/gstrtpptdemux.c
index b11ff11a..f3121cb4 100644
--- a/gst/rtpmanager/gstrtpptdemux.c
+++ b/gst/rtpmanager/gstrtpptdemux.c
@@ -273,7 +273,10 @@ gst_rtp_pt_demux_get_caps (GstRtpPtDemux * rtpdemux, guint pt)
   g_signal_emitv (args, gst_rtp_pt_demux_signals[SIGNAL_REQUEST_PT_MAP], 0,
       &ret);
 
-  caps = g_value_get_boxed (&ret);
+  g_value_unset (&args[0]);
+  g_value_unset (&args[1]);
+  caps = g_value_dup_boxed (&ret);
+  g_value_unset (&ret);
   if (caps == NULL)
     caps = GST_PAD_CAPS (rtpdemux->sink);
 
diff --git a/gst/rtpmanager/gstrtpsession.c b/gst/rtpmanager/gstrtpsession.c
index 3f7053d7..a73de15b 100644
--- a/gst/rtpmanager/gstrtpsession.c
+++ b/gst/rtpmanager/gstrtpsession.c
@@ -1244,7 +1244,10 @@ gst_rtp_session_clock_rate (RTPSession * sess, guint8 payload,
   g_signal_emitv (args, gst_rtp_session_signals[SIGNAL_REQUEST_PT_MAP], 0,
       &ret);
 
-  caps = (GstCaps *) g_value_get_boxed (&ret);
+  g_value_unset (&args[0]);
+  g_value_unset (&args[1]);
+  caps = (GstCaps *) g_value_dup_boxed (&ret);
+  g_value_unset (&ret);
   if (!caps)
     goto no_caps;