diff options
| author | Sagar Nageshmurthy <s.nageshmurt@samsung.com> | 2015-03-24 17:17:03 +0530 |
|---|---|---|
| committer | David Henningsson <david.henningsson@canonical.com> | 2015-03-27 14:34:15 +0100 |
| commit | ff329cdabb9ed5864ff6821aaab137844f9940d5 (patch) | |
| tree | 19698d6ef75d86285a29ac60df4df35dd90ad2c1 | |
| parent | 498689926fc3a13207ec07128339972cdbb2eefc (diff) | |
Fix: Prevent calling pa_rtpoll_free() for a NULL rtpoll
Flushing the asyncmsgq can cause arbitrarily callbacks to run, potentially
causing recursion into pa_thread_mq_done again. Because of this; rtpoll which
is cleared in the second iteration is tried to free once again by the first
iteration leading to PA crash.
| -rw-r--r-- | src/modules/bluetooth/module-bluez5-device.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/modules/bluetooth/module-bluez5-device.c b/src/modules/bluetooth/module-bluez5-device.c index 7238e6f81..6ebcda23c 100644 --- a/src/modules/bluetooth/module-bluez5-device.c +++ b/src/modules/bluetooth/module-bluez5-device.c @@ -1575,9 +1575,9 @@ static void stop_thread(struct userdata *u) { } if (u->rtpoll) { - pa_thread_mq_done(&u->thread_mq); pa_rtpoll_free(u->rtpoll); u->rtpoll = NULL; + pa_thread_mq_done(&u->thread_mq); } if (u->transport) { |