Commit 541801d4 authored by Jakub Adam's avatar Jakub Adam
Browse files

component: Fix use-after-free

conn_check_prune_socket() was trying to access deleted NiceCandidate
instance. Prune the socket before removing the candidate.

Closes #73
parent 67807a17
......@@ -188,10 +188,14 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
refresh_prune_candidate (agent, candidate);
if (candidate->sockptr != nsocket && stream) {
discovery_prune_socket (agent, candidate->sockptr);
discovery_prune_socket (agent, candidate->sockptr);
if (stream) {
conn_check_prune_socket (agent, stream, cmp,
/* Keep nsocket alive since it's used in the loop. */
if (candidate->sockptr != nsocket) {
nice_component_detach_socket (cmp, candidate->sockptr);
agent_remove_local_candidate (agent, candidate);
......@@ -201,9 +205,6 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
i = next;
discovery_prune_socket (agent, nsocket);
if (stream)
conn_check_prune_socket (agent, stream, cmp, nsocket);
nice_component_detach_socket (cmp, nsocket);
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment