Commit 541801d4 authored by Jakub Adam's avatar Jakub Adam

component: Fix use-after-free

conn_check_prune_socket() was trying to access deleted NiceCandidate
instance. Prune the socket before removing the candidate.

Closes #73
parent 67807a17
...@@ -188,10 +188,14 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp, ...@@ -188,10 +188,14 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
} }
refresh_prune_candidate (agent, candidate); refresh_prune_candidate (agent, candidate);
if (candidate->sockptr != nsocket && stream) { discovery_prune_socket (agent, candidate->sockptr);
discovery_prune_socket (agent, candidate->sockptr); if (stream) {
conn_check_prune_socket (agent, stream, cmp, conn_check_prune_socket (agent, stream, cmp,
candidate->sockptr); candidate->sockptr);
}
/* Keep nsocket alive since it's used in the loop. */
if (candidate->sockptr != nsocket) {
nice_component_detach_socket (cmp, candidate->sockptr); nice_component_detach_socket (cmp, candidate->sockptr);
} }
agent_remove_local_candidate (agent, candidate); agent_remove_local_candidate (agent, candidate);
...@@ -201,9 +205,6 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp, ...@@ -201,9 +205,6 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
i = next; i = next;
} }
discovery_prune_socket (agent, nsocket);
if (stream)
conn_check_prune_socket (agent, stream, cmp, nsocket);
nice_component_detach_socket (cmp, nsocket); nice_component_detach_socket (cmp, nsocket);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment