webrtc_data_channel: Fix use-after-free issue

(cherry-picked from tizen branch)

[Version] 0.4.60
[Issue Type] ASAN defect

Change-Id: Idae9729c00520ca6aa55655fb795c0c9175ed6c0
Signed-off-by: Sangchul Lee <sc11.lee@samsung.com>

diff --git a/packaging/capi-media-webrtc.spec b/packaging/capi-media-webrtc.spec
index cc4c9f700843090ea3514b71f759c70a651d2d32..3fe0f2cb76fadbb3d1cbf63a043fb72913d415fa 100644 (file)
--- a/packaging/capi-media-webrtc.spec
+++ b/packaging/capi-media-webrtc.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-webrtc
 Summary:    A WebRTC library in Tizen Native API
-Version:    0.4.59
+Version:    0.4.60
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/webrtc_data_channel.c b/src/webrtc_data_channel.c
index 524073282b88969a7bffe33dd4be65213b821edb..a14b5dedfea7ca36cb61554f8a9597c3215d7158 100644 (file)
--- a/src/webrtc_data_channel.c
+++ b/src/webrtc_data_channel.c
@@ -247,9 +247,9 @@ int _destroy_data_channel(webrtc_data_channel_s *channel)
        RET_VAL_IF(channel == NULL, WEBRTC_ERROR_INVALID_PARAMETER, "channel is NULL");
        RET_VAL_IF(channel->from_remote, WEBRTC_ERROR_INVALID_PARAMETER, "do not destroy a data channel obtained from _on_data_channel_cb()");
 
-       g_hash_table_remove(channel->webrtc->data_channels, channel);
+       LOG_INFO("data channel[%p, object:%p] will be destroyed", channel, channel->channel);
 
-       LOG_INFO("data channel[%p, object:%p] is destroyed", channel, channel->channel);
+       g_hash_table_remove(channel->webrtc->data_channels, channel);
 
        return WEBRTC_ERROR_NONE;
 }