Commit 6303ed6f authored by Fabrice Bellet's avatar Fabrice Bellet Committed by Olivier Crête
Browse files

component: remove socket also from remote candidates

A socket to be removed may also come from a peer-reflexive remote
candidate, and some cleanup also needs to be done in this case. This
reference in a remote peer-reflexive tcp-active candidate caused a
heap-use-after-free asan error in some custom debugging dump of the list
of sockets of a component, after a read error in component_io_cb():

agent_recv_message_unlocked returned -1, errno (25) :
Inappropriate ioctl for device
parent b3c347bd
...@@ -205,6 +205,33 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp, ...@@ -205,6 +205,33 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
i = next; i = next;
} }
/* The nsocket to be removed may also come from a
* peer-reflexive remote candidate
*/
for (i = cmp->remote_candidates; i;) {
NiceCandidate *candidate = i->data;
GSList *next = i->next;
if (candidate->sockptr != nsocket) {
i = next;
continue;
}
if (candidate == cmp->selected_pair.remote) {
nice_component_clear_selected_pair (cmp);
agent_signal_component_state_change (agent, cmp->stream_id,
cmp->id, NICE_COMPONENT_STATE_FAILED);
}
if (stream)
conn_check_prune_socket (agent, stream, cmp, candidate->sockptr);
nice_candidate_free (candidate);
cmp->remote_candidates = g_slist_delete_link (cmp->remote_candidates, i);
i = next;
}
nice_component_detach_socket (cmp, nsocket); nice_component_detach_socket (cmp, nsocket);
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment