From: Fabrice Bellet <fabrice@bellet.info>
Date: Wed, 12 Jun 2019 13:58:41 +0000 (+0200)
Subject: socket: fix a heap use-after-free on the send queue
X-Git-Tag: 0.1.17~178
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f482a02c7970e3ac27c6d60d854eecb1dfaeb9f9;p=platform%2Fupstream%2Flibnice.git

socket: fix a heap use-after-free on the send queue
---

diff --git a/socket/socket.c b/socket/socket.c
index 260a190..b60d2d3 100644
--- a/socket/socket.c
+++ b/socket/socket.c
@@ -358,12 +358,6 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue,
   else
     g_queue_push_tail (send_queue, tbs);
 
-  if (io_source && gsock && context && cb && *io_source == NULL) {
-    *io_source = g_socket_create_source(gsock, G_IO_OUT, NULL);
-    g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL);
-    g_source_attach (*io_source, context);
-  }
-
   /* Move the data into the buffer. */
   for (j = 0;
        (message->n_buffers >= 0 && j < (guint) message->n_buffers) ||
@@ -386,6 +380,12 @@ void nice_socket_queue_send_with_callback (GQueue *send_queue,
     else
       message_offset = 0;
   }
+
+  if (io_source && gsock && context && cb && *io_source == NULL) {
+    *io_source = g_socket_create_source(gsock, G_IO_OUT, NULL);
+    g_source_set_callback (*io_source, (GSourceFunc) G_CALLBACK (cb), user_data, NULL);
+    g_source_attach (*io_source, context);
+  }
 }
 
 void nice_socket_flush_send_queue (NiceSocket *base_socket, GQueue *send_queue)