Commit 6303ed6f authored by Fabrice Bellet's avatar Fabrice Bellet Committed by Olivier Crête
Browse files

component: remove socket also from remote candidates

A socket to be removed may also come from a peer-reflexive remote
candidate, and some cleanup also needs to be done in this case. This
reference in a remote peer-reflexive tcp-active candidate caused a
heap-use-after-free asan error in some custom debugging dump of the list
of sockets of a component, after a read error in component_io_cb():

agent_recv_message_unlocked returned -1, errno (25) :
Inappropriate ioctl for device
parent b3c347bd
......@@ -205,6 +205,33 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
i = next;
/* The nsocket to be removed may also come from a
* peer-reflexive remote candidate
for (i = cmp->remote_candidates; i;) {
NiceCandidate *candidate = i->data;
GSList *next = i->next;
if (candidate->sockptr != nsocket) {
i = next;
if (candidate == cmp->selected_pair.remote) {
nice_component_clear_selected_pair (cmp);
agent_signal_component_state_change (agent, cmp->stream_id,
if (stream)
conn_check_prune_socket (agent, stream, cmp, candidate->sockptr);
nice_candidate_free (candidate);
cmp->remote_candidates = g_slist_delete_link (cmp->remote_candidates, i);
i = next;
nice_component_detach_socket (cmp, nsocket);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment