fix use-after-free: the call to mesh_channel_destroy will ultimately free 'op', so we must not update 'op' after the call; however, it is a good idea to clean up the 'channel' field just before the call (#3164)

1 files changed, 3 insertions, 2 deletions

diff --git a/src/set/gnunet-service-set.c b/src/set/gnunet-service-set.c
index 27c8d3bc0..13bb38292 100644
--- a/src/set/gnunet-service-set.c
+++ b/src/set/gnunet-service-set.c
@@ -284,6 +284,7 @@ void
 _GSS_operation_destroy (struct Operation *op)
 {
   struct Set *set;
+  struct GNUNET_MESH_Channel *channel;
 
   if (NULL == op->vt)
     return;
@@ -316,10 +317,10 @@ _GSS_operation_destroy (struct Operation *op)
     op->mq = NULL;
   }
 
-  if (NULL != op->channel)
+  if (NULL != (channel = op->channel))
   {
-    GNUNET_MESH_channel_destroy (op->channel);
     op->channel = NULL;
+    GNUNET_MESH_channel_destroy (channel);
   }
 
   collect_generation_garbage (set);