diff options
| author | Yonit Halperin <yhalperi@redhat.com> | 2012-10-11 20:20:16 +0200 |
|---|---|---|
| committer | Yonit Halperin <yhalperi@redhat.com> | 2012-10-11 20:23:47 +0200 |
| commit | a179434aa9371a037a63858884f64b3cc06ff955 (patch) | |
| tree | 15e95f748842cbe0f46cec9cfc661fc02051e479 /server/snd_worker.c | |
| parent | 7f8905e58a5f99221064cb8061583aae2cad22e8 (diff) | |
| download | spice-a179434aa9371a037a63858884f64b3cc06ff955.tar.gz spice-a179434aa9371a037a63858884f64b3cc06ff955.tar.xz spice-a179434aa9371a037a63858884f64b3cc06ff955.zip | |
snd channel: fix accessing freed memory
snd_channel_put freed "channel", and then channel->worker was accessed.
It caused segmentation faults during connections and disconnections of the client.
Diffstat (limited to 'server/snd_worker.c')
| -rw-r--r-- | server/snd_worker.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/server/snd_worker.c b/server/snd_worker.c index a12397eb..bc7be51f 100644 --- a/server/snd_worker.c +++ b/server/snd_worker.c @@ -214,9 +214,9 @@ static void snd_disconnect_channel(SndChannel *channel) return; } spice_debug("%p", channel); + worker = channel->worker; if (channel->stream) { channel->cleanup(channel); - worker = channel->worker; red_channel_client_disconnect(worker->connection->channel_client); core->watch_remove(channel->stream->watch); channel->stream->watch = NULL; @@ -225,7 +225,7 @@ static void snd_disconnect_channel(SndChannel *channel) spice_marshaller_destroy(channel->send_data.marshaller); } snd_channel_put(channel); - channel->worker->connection = NULL; + worker->connection = NULL; } static void snd_playback_free_frame(PlaybackChannel *playback_channel, AudioFrame *frame) |