diff options
author | Fabrice Bellet <fabrice@bellet.info> | 2019-06-18 20:54:16 +0200 |
---|---|---|
committer | Olivier CrĂȘte <olivier.crete@collabora.com> | 2019-07-04 17:03:43 -0400 |
commit | 6303ed6fd7aea7ac1d1d2ab06dabaa08e233735a (patch) | |
tree | 1890fd1cc6324c0f956d69a9a2cb384a8a771105 /agent | |
parent | b3c347bdd1aee6e4ff560c3b319c6428f44405dd (diff) | |
download | libnice-6303ed6fd7aea7ac1d1d2ab06dabaa08e233735a.tar.gz |
component: remove socket also from remote candidates
A socket to be removed may also come from a peer-reflexive remote
candidate, and some cleanup also needs to be done in this case. This
reference in a remote peer-reflexive tcp-active candidate caused a
heap-use-after-free asan error in some custom debugging dump of the list
of sockets of a component, after a read error in component_io_cb():
agent_recv_message_unlocked returned -1, errno (25) :
Inappropriate ioctl for device
Diffstat (limited to 'agent')
-rw-r--r-- | agent/component.c | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/agent/component.c b/agent/component.c index f81f6ce..720dd39 100644 --- a/agent/component.c +++ b/agent/component.c @@ -205,6 +205,33 @@ nice_component_remove_socket (NiceAgent *agent, NiceComponent *cmp, i = next; } + /* The nsocket to be removed may also come from a + * peer-reflexive remote candidate + */ + for (i = cmp->remote_candidates; i;) { + NiceCandidate *candidate = i->data; + GSList *next = i->next; + + if (candidate->sockptr != nsocket) { + i = next; + continue; + } + + if (candidate == cmp->selected_pair.remote) { + nice_component_clear_selected_pair (cmp); + agent_signal_component_state_change (agent, cmp->stream_id, + cmp->id, NICE_COMPONENT_STATE_FAILED); + } + + if (stream) + conn_check_prune_socket (agent, stream, cmp, candidate->sockptr); + + nice_candidate_free (candidate); + + cmp->remote_candidates = g_slist_delete_link (cmp->remote_candidates, i); + i = next; + } + nice_component_detach_socket (cmp, nsocket); } |