Fix coverity issue - Read from pointer after free

[Version] 0.3.17
[Profile] Common
[Issue Type] Coverity

Change-Id: Ic2ca9ea401815e3b6fcdf633619cd5df2075a770
Signed-off-by: Jeongmo Yang <jm80.yang@samsung.com>

diff --git a/muse/src/muse_recorder_dispatcher.c b/muse/src/muse_recorder_dispatcher.c
index 8392b0b..9e85ef2 100644 (file)
--- a/muse/src/muse_recorder_dispatcher.c
+++ b/muse/src/muse_recorder_dispatcher.c
@@ -527,39 +527,42 @@ static int _recorder_remove_export_data(muse_module_h module, tbm_fd fd, int rem
 
        while (tmp_list) {
                export_data = (muse_recorder_export_data *)tmp_list->data;
-               if (export_data) {
-                       if (export_data->fd == fd || remove_all) {
-                               /*LOGD("fd %d matched, remove it (remove_all %d)", fd, remove_all);*/
-
-                               if (export_data->bo) {
-                                       tbm_bo_unref(export_data->bo);
-                                       export_data->bo = NULL;
-                               } else {
-                                       LOGW("bo for fd %d is NULL", fd);
-                               }
-
-                               /* close exported fd */
-                               close(export_data->fd);
-                               export_data->fd = -1;
-
-                               muse_recorder->data_list = g_list_remove(muse_recorder->data_list, export_data);
-
-                               g_free(export_data);
-                               export_data = NULL;
-
-                               if (remove_all == FALSE) {
-                                       /*LOGD("fd %d, remove done", fd);*/
-                                       g_mutex_unlock(&muse_recorder->list_lock);
-                                       return TRUE;
-                               } else {
-                                       LOGD("check next data");
-                               }
-                       }
-               } else {
+
+               tmp_list = tmp_list->next;
+
+               if (export_data == NULL) {
                        LOGW("NULL data");
+                       continue;
                }
 
-               tmp_list = tmp_list->next;
+               if (export_data->fd != fd && remove_all == FALSE)
+                       continue;
+
+               /*LOGD("fd %d matched, remove it (remove_all %d)", fd, remove_all);*/
+
+               if (export_data->bo) {
+                       tbm_bo_unref(export_data->bo);
+                       export_data->bo = NULL;
+               } else {
+                       LOGW("bo for fd %d is NULL", fd);
+               }
+
+               /* close exported fd */
+               close(export_data->fd);
+               export_data->fd = -1;
+
+               muse_recorder->data_list = g_list_remove(muse_recorder->data_list, export_data);
+
+               g_free(export_data);
+               export_data = NULL;
+
+               if (remove_all == FALSE) {
+                       /*LOGD("fd %d, remove done", fd);*/
+                       g_mutex_unlock(&muse_recorder->list_lock);
+                       return TRUE;
+               } else {
+                       LOGD("check next data");
+               }
        }
 
        g_mutex_unlock(&muse_recorder->list_lock);

diff --git a/packaging/mmsvc-recorder.spec b/packaging/mmsvc-recorder.spec
index ed3744c..222f02a 100644 (file)
--- a/packaging/mmsvc-recorder.spec
+++ b/packaging/mmsvc-recorder.spec
@@ -1,6 +1,6 @@
 Name:       mmsvc-recorder
 Summary:    A Recorder module for muse server
-Version:    0.3.16
+Version:    0.3.17
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0