device: Free network after resetting service

After g_hash_table_remove(device->networks, identifier); the previously
cached service pointer can be invalid.

Bug reported by: Daniel Wagner <daniel.wagner@bmw-carit.de>

diff --git a/src/device.c b/src/device.c
index e5bd84d..a3718a9 100644 (file)
--- a/src/device.c
+++ b/src/device.c
@@ -1117,11 +1117,13 @@ int connman_device_remove_network(struct connman_device *device,
        service = __connman_service_lookup_from_network(network);
 
        identifier = connman_network_get_identifier(network);
-       g_hash_table_remove(device->networks, identifier);
+       g_hash_table_steal(device->networks, identifier);
 
        if (service != NULL)
                __connman_service_reset_from_networks(service, device->networks);
 
+       free_network(network);
+
        return 0;
 }