component: remove socket also from remote candidates

A socket to be removed may also come from a peer-reflexive remote
candidate, and some cleanup also needs to be done in this case. This
reference in a remote peer-reflexive tcp-active candidate caused a
heap-use-after-free asan error in some custom debugging dump of the list
of sockets of a component, after a read error in component_io_cb():

agent_recv_message_unlocked returned -1, errno (25) :
Inappropriate ioctl for device

1 files changed, 27 insertions, 0 deletions

diff --git a/agent/component.c b/agent/component.c
index f81f6ce..720dd39 100644
--- a/agent/component.c
+++ b/agent/component.c
@@ -205,6 +205,33 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp,
     i = next;
   }
 
+  /* The nsocket to be removed may also come from a
+   * peer-reflexive remote candidate
+   */
+  for (i = cmp->remote_candidates; i;) {
+    NiceCandidate *candidate = i->data;
+    GSList *next = i->next;
+
+    if (candidate->sockptr != nsocket) {
+      i = next;
+      continue;
+    }
+
+    if (candidate == cmp->selected_pair.remote) {
+      nice_component_clear_selected_pair (cmp);
+      agent_signal_component_state_change (agent, cmp->stream_id,
+          cmp->id, NICE_COMPONENT_STATE_FAILED);
+    }
+
+    if (stream)
+      conn_check_prune_socket (agent, stream, cmp, candidate->sockptr);
+
+    nice_candidate_free (candidate);
+
+    cmp->remote_candidates = g_slist_delete_link (cmp->remote_candidates, i);
+    i = next;
+  }
+
   nice_component_detach_socket (cmp, nsocket);
 }