webrtc_data_channel: Fix use-after-free issue

(cherry-picked from tizen branch)

[Version] 0.3.305
[Issue Type] ASAN defect

Change-Id: Idae9729c00520ca6aa55655fb795c0c9175ed6c0
Signed-off-by: Sangchul Lee <sc11.lee@samsung.com>

diff --git a/packaging/capi-media-webrtc.spec b/packaging/capi-media-webrtc.spec
index d1d151d59a4859741cc4dbffcf5d098b5a6707ad..55aaa404ec26ecdd58f9f3e2c4711fc912317313 100644 (file)
--- a/packaging/capi-media-webrtc.spec
+++ b/packaging/capi-media-webrtc.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-webrtc
 Summary:    A WebRTC library in Tizen Native API
-Version:    0.3.304
+Version:    0.3.305
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/webrtc_data_channel.c b/src/webrtc_data_channel.c
index ba9e19db59f2ae59b9b19634980ebc7424a7a1c2..288fbd2a7861e6454fe156de9db97d63edd8263c 100644 (file)
--- a/src/webrtc_data_channel.c
+++ b/src/webrtc_data_channel.c
@@ -252,9 +252,9 @@ int _destroy_data_channel(webrtc_data_channel_s *channel)
        RET_VAL_IF(channel == NULL, WEBRTC_ERROR_INVALID_PARAMETER, "channel is NULL");
        RET_VAL_IF(channel->from_remote, WEBRTC_ERROR_INVALID_PARAMETER, "do not destroy a data channel obtained from _on_data_channel_cb()");
 
-       g_hash_table_remove(channel->webrtc->data_channels, channel);
+       LOG_INFO("data channel[%p, object:%p] will be destroyed", channel, channel->channel);
 
-       LOG_INFO("data channel[%p, object:%p] is destroyed", channel, channel->channel);
+       g_hash_table_remove(channel->webrtc->data_channels, channel);
 
        return WEBRTC_ERROR_NONE;
 }