Commit 8ccac4b0 authored by Olivier Crête's avatar Olivier Crête

agent: Verify the source before dereferencing the pointer

The reason is that the component object could have been destroyed in the
mean time.
parent a3f53566
......@@ -5672,25 +5672,31 @@ component_io_cb (GSocket *gsocket, GIOCondition condition, gpointer user_data)
component = socket_source->component;
if (g_source_is_destroyed (g_main_current_source ())) {
/* Silently return FALSE. */
nice_debug ("%s: source %p destroyed", G_STRFUNC, g_main_current_source ());
return G_SOURCE_REMOVE;
}
agent = g_weak_ref_get (&component->agent_ref);
if (agent == NULL)
return G_SOURCE_REMOVE;
agent_lock (agent);
stream = agent_find_stream (agent, component->stream_id);
if (stream == NULL) {
nice_debug ("%s: stream %d destroyed", G_STRFUNC, component->stream_id);
if (g_source_is_destroyed (g_main_current_source ())) {
/* Silently return FALSE. */
nice_debug ("%s: source %p destroyed", G_STRFUNC, g_main_current_source ());
agent_unlock (agent);
g_object_unref (agent);
return G_SOURCE_REMOVE;
}
if (g_source_is_destroyed (g_main_current_source ())) {
/* Silently return FALSE. */
nice_debug ("%s: source %p destroyed", G_STRFUNC, g_main_current_source ());
stream = agent_find_stream (agent, component->stream_id);
if (stream == NULL) {
nice_debug ("%s: stream %d destroyed", G_STRFUNC, component->stream_id);
agent_unlock (agent);
g_object_unref (agent);
......
......@@ -1222,6 +1222,7 @@ nice_component_finalize (GObject *obj)
cmp = NICE_COMPONENT (obj);
/* Component should have been closed already. */
g_warn_if_fail (cmp->socket_sources == NULL);
g_warn_if_fail (cmp->local_candidates == NULL);
g_warn_if_fail (cmp->remote_candidates == NULL);
g_warn_if_fail (g_queue_get_length (&cmp->incoming_checks) == 0);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment