agent: Clear existing GSource timeouts before adding new ones

Modify agent_timeout_add_with_context() to force destroying and freeing
of an existing GSource before overwriting it with a new one (probably
with an updated timeout period).

This fixes a case in priv_map_reply_to_relay_refresh() where the TURN
candidate refresh timer was being overwritten with a new one, without
the old one being destroyed. This lead to two timeouts existing, only
one of which would be destroyed when the CandidateRefresh struct was
freed, leaking the other one (in the main context) and allowing it to be
later dispatched with a dangling CandidateRefresh pointer.

The modification to agent_timeout_add_with_context() should prevent this
happening in new code in future.

1 files changed, 3 insertions, 4 deletions

diff --git a/agent/discovery.c b/agent/discovery.c
index c5d9220..83cd3c2 100644
--- a/agent/discovery.c
+++ b/agent/discovery.c
@@ -1169,10 +1169,9 @@ void discovery_schedule (NiceAgent *agent)
       /* step: run first iteration immediately */
       gboolean res = priv_discovery_tick_unlocked (agent);
       if (res == TRUE) {
-        agent->discovery_timer_source =
-            agent_timeout_add_with_context (agent,
-                "Candidate discovery tick", agent->timer_ta,
-                priv_discovery_tick, agent);
+        agent_timeout_add_with_context (agent, &agent->discovery_timer_source,
+            "Candidate discovery tick", agent->timer_ta,
+            priv_discovery_tick, agent);
       }
     }
   }