Commit 541801d4 authored by Jakub Adam's avatar Jakub Adam

component: Fix use-after-free

conn_check_prune_socket() was trying to access deleted NiceCandidate
instance. Prune the socket before removing the candidate.

Closes #73
parent 67807a17
Pipeline #28548 passed with stages
in 3 minutes and 53 seconds
......@@ -188,10 +188,14 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
}
refresh_prune_candidate (agent, candidate);
if (candidate->sockptr != nsocket && stream) {
discovery_prune_socket (agent, candidate->sockptr);
discovery_prune_socket (agent, candidate->sockptr);
if (stream) {
conn_check_prune_socket (agent, stream, cmp,
candidate->sockptr);
}
/* Keep nsocket alive since it's used in the loop. */
if (candidate->sockptr != nsocket) {
nice_component_detach_socket (cmp, candidate->sockptr);
}
agent_remove_local_candidate (agent, candidate);
......@@ -201,9 +205,6 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
i = next;
}
discovery_prune_socket (agent, nsocket);
if (stream)
conn_check_prune_socket (agent, stream, cmp, nsocket);
nice_component_detach_socket (cmp, nsocket);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment