fix double free

- remove g_list first,
  unexpected remove_message_all function within callback free list item first.
  so that, FREE after callback cause double free.

Signed-off-by: SeokHoon Lee <andy.shlee@samsung.com>
Change-Id: I28790e0d64daa3ecf3de79208d742ec6234041e7

diff --git a/packaging/libmm-streamrecorder.spec b/packaging/libmm-streamrecorder.spec
index 26fb19d..6807f2a 100644 (file)
--- a/packaging/libmm-streamrecorder.spec
+++ b/packaging/libmm-streamrecorder.spec
@@ -1,6 +1,6 @@
 Name:       libmm-streamrecorder
 Summary:    Media Stream Recorder library
-Version:    0.0.16
+Version:    0.0.17
 Release:    0
 Group:      Multimedia/Other
 License:    Apache-2.0

diff --git a/src/mm_streamrecorder_gstdispatch.c b/src/mm_streamrecorder_gstdispatch.c
index 9ff61cd..8a0cf6a 100644 (file)
--- a/src/mm_streamrecorder_gstdispatch.c
+++ b/src/mm_streamrecorder_gstdispatch.c
@@ -302,6 +302,12 @@ gboolean _mmstreamrecorder_msg_callback(void *data)
                goto MSG_CALLBACK_DONE;
        }
 
+       _MMSTREAMRECORDER_LOCK((MMHandleType) hstreamrecorder);
+       if (hstreamrecorder->msg_data)
+               hstreamrecorder->msg_data = g_list_remove(hstreamrecorder->msg_data, item);
+
+       _MMSTREAMRECORDER_UNLOCK((MMHandleType) hstreamrecorder);
+
        /* _mmstreamrec_dbg_log("msg id:%x, msg_cb:%p, msg_data:%p, item:%p", item->id, hstreamrecorder->msg_cb, hstreamrecorder->msg_data, item); */
        _MMSTREAMRECORDER_LOCK_MESSAGE_CALLBACK(hstreamrecorder);
 
@@ -310,12 +316,6 @@ gboolean _mmstreamrecorder_msg_callback(void *data)
 
        _MMSTREAMRECORDER_UNLOCK_MESSAGE_CALLBACK(hstreamrecorder);
 
-       _MMSTREAMRECORDER_LOCK((MMHandleType) hstreamrecorder);
-       if (hstreamrecorder->msg_data)
-               hstreamrecorder->msg_data = g_list_remove(hstreamrecorder->msg_data, item);
-
-       _MMSTREAMRECORDER_UNLOCK((MMHandleType) hstreamrecorder);
-
 MSG_CALLBACK_DONE:
        /* release allocated memory */
        if (item->id == MM_MESSAGE_STREAMRECORDER_VIDEO_CAPTURED ||