Commit f482a02c authored by Fabrice Bellet's avatar Fabrice Bellet Committed by Olivier Crête

socket: fix a heap use-after-free on the send queue

parent a383faa4
...@@ -358,12 +358,6 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue, ...@@ -358,12 +358,6 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue,
else else
g_queue_push_tail (send_queue, tbs); g_queue_push_tail (send_queue, tbs);
if (io_source && gsock && context && cb && *io_source == NULL) {
*io_source = g_socket_create_source(gsock, G_IO_OUT, NULL);
g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL);
g_source_attach (*io_source, context);
}
/* Move the data into the buffer. */ /* Move the data into the buffer. */
for (j = 0; for (j = 0;
(message->n_buffers >= 0 && j < (guint) message->n_buffers) || (message->n_buffers >= 0 && j < (guint) message->n_buffers) ||
...@@ -386,6 +380,12 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue, ...@@ -386,6 +380,12 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue,
else else
message_offset = 0; message_offset = 0;
} }
if (io_source && gsock && context && cb && *io_source == NULL) {
*io_source = g_socket_create_source(gsock, G_IO_OUT, NULL);
g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL);
g_source_attach (*io_source, context);
}
} }
void nice_socket_flush_send_queue (NiceSocket *base_socket, GQueue *send_queue) void nice_socket_flush_send_queue (NiceSocket *base_socket, GQueue *send_queue)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment