diff options
author | Fabrice Bellet <fabrice@bellet.info> | 2019-06-12 15:58:41 +0200 |
---|---|---|
committer | Olivier CrĂȘte <olivier.crete@collabora.com> | 2019-07-04 17:03:43 -0400 |
commit | f482a02c7970e3ac27c6d60d854eecb1dfaeb9f9 (patch) | |
tree | 606cd2650f839681cc878e0d388ef9788f8c286f /socket | |
parent | a383faa4949258ec551a6286ce6f5487ccf1cada (diff) | |
download | libnice-f482a02c7970e3ac27c6d60d854eecb1dfaeb9f9.tar.gz |
socket: fix a heap use-after-free on the send queue
Diffstat (limited to 'socket')
-rw-r--r-- | socket/socket.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/socket/socket.c b/socket/socket.c index 260a190..b60d2d3 100644 --- a/socket/socket.c +++ b/socket/socket.c @@ -358,12 +358,6 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue, else g_queue_push_tail (send_queue, tbs); - if (io_source && gsock && context && cb && *io_source == NULL) { - *io_source = g_socket_create_source(gsock, G_IO_OUT, NULL); - g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL); - g_source_attach (*io_source, context); - } - /* Move the data into the buffer. */ for (j = 0; (message->n_buffers >= 0 && j < (guint) message->n_buffers) || @@ -386,6 +380,12 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue, else message_offset = 0; } + + if (io_source && gsock && context && cb && *io_source == NULL) { + *io_source = g_socket_create_source(gsock, G_IO_OUT, NULL); + g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL); + g_source_attach (*io_source, context); + } } void nice_socket_flush_send_queue (NiceSocket *base_socket, GQueue *send_queue) |