agent: Fix use of freed stream in nice_agent_dispose()

nice_stream_close() calls agent_find_stream(), which iterates over
agent->streams list.

Therefore, when we're freeing agent->streams in a loop, we must also
delete the respective GSList item from the list at the end of each
iteration. Otherwise agent_find_stream() would stumble over already
deleted NiceStream instance the next time it gets called.

Fixes random crashes when running test-different-number-streams on
Windows.

1 files changed, 6 insertions, 8 deletions

diff --git a/agent/agent.c b/agent/agent.c
index d89fffe..2fe07a1 100644
--- a/agent/agent.c
+++ b/agent/agent.c
@@ -5102,16 +5102,14 @@ nice_agent_dispose (GObject *object)
   g_slist_free (agent->local_addresses);
   agent->local_addresses = NULL;
 
-  for (i = agent->streams; i; i = i->next)
-    {
-      NiceStream *s = i->data;
+  while (agent->streams) {
+    NiceStream *s = agent->streams->data;
 
-      nice_stream_close (agent, s);
-      g_object_unref (s);
-    }
+    nice_stream_close (agent, s);
+    g_object_unref (s);
 
-  g_slist_free (agent->streams);
-  agent->streams = NULL;
+    agent->streams = g_slist_delete_link(agent->streams, agent->streams);
+  }
 
   while ((sig = g_queue_pop_head (&agent->pending_signals))) {
     free_queued_signal (sig);