[GNUnet-SVN] r36005 - gnunet/src/rps

[gnunet]

Author: bartpolot
Date: 2015-06-26 17:04:02 +0200 (Fri, 26 Jun 2015)
New Revision: 36005

Modified:
   gnunet/src/rps/gnunet-service-rps.c
Log:
- GNUNET_CADET_disconnect will destroy pending channels and call the cleanup 
callback on them, and cleanup_channel does access peer_map. If peer_map is 
destroyed before CADET_disconnect, a use-after-free happens.

Modified: gnunet/src/rps/gnunet-service-rps.c
===================================================================
--- gnunet/src/rps/gnunet-service-rps.c 2015-06-26 12:42:09 UTC (rev 36004)
+++ gnunet/src/rps/gnunet-service-rps.c 2015-06-26 15:04:02 UTC (rev 36005)
@@ -2380,7 +2380,7 @@
                        0);
   }
 
-  /* If we are still waiting for notification whether this peer is live 
+  /* If we are still waiting for notification whether this peer is live
    * cancel the according task */
   if (NULL != peer_ctx->is_live_task)
   {
@@ -2498,8 +2498,8 @@
        "Size of the peermap: %u\n",
        GNUNET_CONTAINER_multipeermap_size (peer_map));
   GNUNET_break (0 == GNUNET_CONTAINER_multipeermap_size (peer_map));
+  GNUNET_CADET_disconnect (cadet_handle);
   GNUNET_CONTAINER_multipeermap_destroy (peer_map);
-  GNUNET_CADET_disconnect (cadet_handle);
   GNUNET_CONTAINER_multipeermap_destroy (view);
   view = NULL;
   GNUNET_array_grow (push_list, push_list_size, 0);