Fixed by decrementing the i_refcount variable in the correct manner -

and therefore freeing the memory only when the i_refcount successfully
went to 0.

The problem was that i_refcount is an unsigned variable, and was being
decremented twice, once erroneously by mosaic_bridge, and then again in
the picture's original pf_release function. If i_refcount started at 1,
it wrapped to the maximum unsigned value rather than -1, failing the
refcount tests in the pf_release function.

Patch Authors: Phil Roffe and David Grellscheid
Signed-off-by: Antoine Cellerier <dionoea@videolan.org>

modules/stream_out/mosaic_bridge.c

@@ -80,8 +80,6 @@ static void ReleasePicture( picture_t *p_pic )
 {
     assert( p_pic );
 
-    if( --p_pic->i_refcount > 0 )
-        return;
 
     if( p_pic->p_sys )
     {
@@ -90,11 +88,14 @@ static void ReleasePicture( picture_t *p_pic )
         pf_release( p_pic );
     }
     else
+    {
+        if( --p_pic->i_refcount == 0 )
         {
             free( p_pic->p_q );
             free( p_pic->p_data_orig );
             free( p_pic );
         }
+    }
 }
 
 /*****************************************************************************